localstack-core 4.13.2.dev4__tar.gz → 4.13.2.dev6__tar.gz

{localstack_core-4.13.2.dev4 → localstack_core-4.13.2.dev6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: localstack-core
-Version: 4.13.2.dev4
+Version: 4.13.2.dev6
 Summary: The core library and runtime of LocalStack
 Author-email: LocalStack Contributors <info@localstack.cloud>
 License-Expression: Apache-2.0
@@ -29,8 +29,8 @@ Requires-Dist: rich>=12.3.0
 Requires-Dist: requests>=2.20.0
 Requires-Dist: semver>=2.10
 Provides-Extra: base-runtime
-Requires-Dist: boto3==1.42.34; extra == "base-runtime"
-Requires-Dist: botocore==1.42.34; extra == "base-runtime"
+Requires-Dist: boto3==1.42.40; extra == "base-runtime"
+Requires-Dist: botocore==1.42.40; extra == "base-runtime"
 Requires-Dist: awscrt!=0.27.1,>=0.13.14; extra == "base-runtime"
 Requires-Dist: cbor2>=5.5.0; extra == "base-runtime"
 Requires-Dist: dill==0.3.6; extra == "base-runtime"
@@ -54,7 +54,7 @@ Requires-Dist: xmltodict>=0.13.0; extra == "base-runtime"
 Requires-Dist: rolo>=0.7; extra == "base-runtime"
 Provides-Extra: runtime
 Requires-Dist: localstack-core[base-runtime]; extra == "runtime"
-Requires-Dist: awscli==1.44.24; extra == "runtime"
+Requires-Dist: awscli==1.44.30; extra == "runtime"
 Requires-Dist: airspeed-ext>=0.6.3; extra == "runtime"
 Requires-Dist: antlr4-python3-runtime==4.13.2; extra == "runtime"
 Requires-Dist: apispec>=5.1.1; extra == "runtime"

{localstack_core-4.13.2.dev4 → localstack_core-4.13.2.dev6}/localstack-core/localstack/aws/api/ec2/__init__.py

@@ -6,6 +6,7 @@ from localstack.aws.api import RequestContext, ServiceRequest, handler
 from localstack.aws.api import ServiceException as ServiceException
 
 AccountID = str
+AdditionalFlexibleNetworkInterfaces = int
 AddressMaxResults = int
 AllocationId = str
 AllowedInstanceType = str
@@ -2661,6 +2662,80 @@ class InstanceType(StrEnum):
     c8a_48xlarge = "c8a.48xlarge"
     c8a_metal_24xl = "c8a.metal-24xl"
     c8a_metal_48xl = "c8a.metal-48xl"
+    c8gb_12xlarge = "c8gb.12xlarge"
+    c8gb_16xlarge = "c8gb.16xlarge"
+    c8gb_24xlarge = "c8gb.24xlarge"
+    c8gb_2xlarge = "c8gb.2xlarge"
+    c8gb_4xlarge = "c8gb.4xlarge"
+    c8gb_8xlarge = "c8gb.8xlarge"
+    c8gb_large = "c8gb.large"
+    c8gb_medium = "c8gb.medium"
+    c8gb_metal_24xl = "c8gb.metal-24xl"
+    c8gb_xlarge = "c8gb.xlarge"
+    c8gb_48xlarge = "c8gb.48xlarge"
+    c8gb_metal_48xl = "c8gb.metal-48xl"
+    m8gb_12xlarge = "m8gb.12xlarge"
+    m8gb_16xlarge = "m8gb.16xlarge"
+    m8gb_24xlarge = "m8gb.24xlarge"
+    m8gb_2xlarge = "m8gb.2xlarge"
+    m8gb_4xlarge = "m8gb.4xlarge"
+    m8gb_8xlarge = "m8gb.8xlarge"
+    m8gb_large = "m8gb.large"
+    m8gb_medium = "m8gb.medium"
+    m8gb_xlarge = "m8gb.xlarge"
+    m8gb_48xlarge = "m8gb.48xlarge"
+    m8gb_metal_24xl = "m8gb.metal-24xl"
+    m8gb_metal_48xl = "m8gb.metal-48xl"
+    m8gn_12xlarge = "m8gn.12xlarge"
+    m8gn_16xlarge = "m8gn.16xlarge"
+    m8gn_24xlarge = "m8gn.24xlarge"
+    m8gn_2xlarge = "m8gn.2xlarge"
+    m8gn_48xlarge = "m8gn.48xlarge"
+    m8gn_4xlarge = "m8gn.4xlarge"
+    m8gn_8xlarge = "m8gn.8xlarge"
+    m8gn_large = "m8gn.large"
+    m8gn_medium = "m8gn.medium"
+    m8gn_xlarge = "m8gn.xlarge"
+    m8gn_metal_24xl = "m8gn.metal-24xl"
+    m8gn_metal_48xl = "m8gn.metal-48xl"
+    x8aedz_12xlarge = "x8aedz.12xlarge"
+    x8aedz_24xlarge = "x8aedz.24xlarge"
+    x8aedz_3xlarge = "x8aedz.3xlarge"
+    x8aedz_6xlarge = "x8aedz.6xlarge"
+    x8aedz_large = "x8aedz.large"
+    x8aedz_metal_12xl = "x8aedz.metal-12xl"
+    x8aedz_metal_24xl = "x8aedz.metal-24xl"
+    x8aedz_xlarge = "x8aedz.xlarge"
+    m8azn_medium = "m8azn.medium"
+    m8azn_large = "m8azn.large"
+    m8azn_xlarge = "m8azn.xlarge"
+    m8azn_3xlarge = "m8azn.3xlarge"
+    m8azn_6xlarge = "m8azn.6xlarge"
+    m8azn_12xlarge = "m8azn.12xlarge"
+    m8azn_24xlarge = "m8azn.24xlarge"
+    m8azn_metal_12xl = "m8azn.metal-12xl"
+    m8azn_metal_24xl = "m8azn.metal-24xl"
+    x8i_large = "x8i.large"
+    x8i_xlarge = "x8i.xlarge"
+    x8i_2xlarge = "x8i.2xlarge"
+    x8i_4xlarge = "x8i.4xlarge"
+    x8i_8xlarge = "x8i.8xlarge"
+    x8i_12xlarge = "x8i.12xlarge"
+    x8i_16xlarge = "x8i.16xlarge"
+    x8i_24xlarge = "x8i.24xlarge"
+    x8i_32xlarge = "x8i.32xlarge"
+    x8i_48xlarge = "x8i.48xlarge"
+    x8i_64xlarge = "x8i.64xlarge"
+    x8i_96xlarge = "x8i.96xlarge"
+    x8i_metal_48xl = "x8i.metal-48xl"
+    x8i_metal_96xl = "x8i.metal-96xl"
+    mac_m4max_metal = "mac-m4max.metal"
+    g7e_2xlarge = "g7e.2xlarge"
+    g7e_4xlarge = "g7e.4xlarge"
+    g7e_8xlarge = "g7e.8xlarge"
+    g7e_12xlarge = "g7e.12xlarge"
+    g7e_24xlarge = "g7e.24xlarge"
+    g7e_48xlarge = "g7e.48xlarge"
 
 
 class InstanceTypeHypervisor(StrEnum):
@@ -14464,6 +14539,7 @@ class NetworkCardInfo(TypedDict, total=False):
     NetworkCardIndex: NetworkCardIndex | None
     NetworkPerformance: NetworkPerformance | None
     MaximumNetworkInterfaces: MaxNetworkInterfaces | None
+    AdditionalFlexibleNetworkInterfaces: AdditionalFlexibleNetworkInterfaces | None
     BaselineBandwidthInGbps: BaselineBandwidthInGbps | None
     PeakBandwidthInGbps: PeakBandwidthInGbps | None
     DefaultEnaQueueCountPerInterface: DefaultEnaQueueCountPerInterface | None
@@ -22515,6 +22591,7 @@ class SearchTransitGatewayRoutesRequest(ServiceRequest):
     Filters: FilterList
     MaxResults: TransitGatewayMaxResults | None
     DryRun: Boolean | None
+    NextToken: String | None
 
 
 TransitGatewayRouteList = list[TransitGatewayRoute]
@@ -22523,6 +22600,7 @@ TransitGatewayRouteList = list[TransitGatewayRoute]
 class SearchTransitGatewayRoutesResult(TypedDict, total=False):
     Routes: TransitGatewayRouteList | None
     AdditionalRoutesAvailable: Boolean | None
+    NextToken: String | None
 
 
 class SecurityGroupRuleDescription(TypedDict, total=False):
@@ -31743,6 +31821,7 @@ class Ec2Api:
         filters: FilterList,
         max_results: TransitGatewayMaxResults | None = None,
         dry_run: Boolean | None = None,
+        next_token: String | None = None,
         **kwargs,
     ) -> SearchTransitGatewayRoutesResult:
         raise NotImplementedError

{localstack_core-4.13.2.dev4 → localstack_core-4.13.2.dev6}/localstack-core/localstack/aws/api/lambda_/__init__.py

@@ -196,6 +196,14 @@ class EndPointType(StrEnum):
 
 class EventSourceMappingMetric(StrEnum):
     EventCount = "EventCount"
+    ErrorCount = "ErrorCount"
+    KafkaMetrics = "KafkaMetrics"
+
+
+class EventSourceMappingSystemLogLevel(StrEnum):
+    DEBUG = "DEBUG"
+    INFO = "INFO"
+    WARN = "WARN"
 
 
 class EventSourcePosition(StrEnum):
@@ -1292,6 +1300,10 @@ class ProvisionedPollerConfig(TypedDict, total=False):
     PollerGroupName: ProvisionedPollerGroupName | None
 
 
+class EventSourceMappingLoggingConfig(TypedDict, total=False):
+    SystemLogLevel: EventSourceMappingSystemLogLevel | None
+
+
 EventSourceMappingMetricList = list[EventSourceMappingMetric]
 
 
@@ -1387,6 +1399,7 @@ class CreateEventSourceMappingRequest(ServiceRequest):
     DocumentDBEventSourceConfig: DocumentDBEventSourceConfig | None
     KMSKeyArn: KMSKeyArn | None
     MetricsConfig: EventSourceMappingMetricsConfig | None
+    LoggingConfig: EventSourceMappingLoggingConfig | None
     ProvisionedPollerConfig: ProvisionedPollerConfig | None
 
 
@@ -1729,6 +1742,7 @@ class EventSourceMappingConfiguration(TypedDict, total=False):
     FilterCriteriaError: FilterCriteriaError | None
     EventSourceMappingArn: EventSourceMappingArn | None
     MetricsConfig: EventSourceMappingMetricsConfig | None
+    LoggingConfig: EventSourceMappingLoggingConfig | None
     ProvisionedPollerConfig: ProvisionedPollerConfig | None
 
 
@@ -2595,6 +2609,7 @@ class UpdateEventSourceMappingRequest(ServiceRequest):
     DocumentDBEventSourceConfig: DocumentDBEventSourceConfig | None
     KMSKeyArn: KMSKeyArn | None
     MetricsConfig: EventSourceMappingMetricsConfig | None
+    LoggingConfig: EventSourceMappingLoggingConfig | None
     ProvisionedPollerConfig: ProvisionedPollerConfig | None
 
 
@@ -2784,6 +2799,7 @@ class LambdaApi:
         document_db_event_source_config: DocumentDBEventSourceConfig | None = None,
         kms_key_arn: KMSKeyArn | None = None,
         metrics_config: EventSourceMappingMetricsConfig | None = None,
+        logging_config: EventSourceMappingLoggingConfig | None = None,
         provisioned_poller_config: ProvisionedPollerConfig | None = None,
         **kwargs,
     ) -> EventSourceMappingConfiguration:
@@ -3547,6 +3563,7 @@ class LambdaApi:
         document_db_event_source_config: DocumentDBEventSourceConfig | None = None,
         kms_key_arn: KMSKeyArn | None = None,
         metrics_config: EventSourceMappingMetricsConfig | None = None,
+        logging_config: EventSourceMappingLoggingConfig | None = None,
         provisioned_poller_config: ProvisionedPollerConfig | None = None,
         **kwargs,
     ) -> EventSourceMappingConfiguration:

{localstack_core-4.13.2.dev4 → localstack_core-4.13.2.dev6}/localstack-core/localstack/aws/api/s3/__init__.py

@@ -118,6 +118,7 @@ NextPartNumberMarker = int
 NextToken = str
 NextUploadIdMarker = str
 NextVersionIdMarker = str
+NonEmptyKmsKeyArnString = str
 NotificationId = str
 ObjectKey = str
 ObjectLockEnabledForBucket = bool
@@ -677,6 +678,21 @@ class Type(StrEnum):
     Group = "Group"
 
 
+ServerTime = datetime
+Expires = datetime
+
+
+class AccessDenied(ServiceException):
+    code: str = "AccessDenied"
+    sender_fault: bool = False
+    status_code: int = 403
+    Expires: Expires | None
+    ServerTime: ServerTime | None
+    X_Amz_Expires: X_Amz_Expires | None
+    HostId: HostId | None
+    HeadersNotSigned: HeadersNotSigned | None
+
+
 class BucketAlreadyExists(ServiceException):
     code: str = "BucketAlreadyExists"
     sender_fault: bool = False
@@ -825,21 +841,6 @@ class SignatureDoesNotMatch(ServiceException):
     StringToSignBytes: StringToSignBytes | None
 
 
-ServerTime = datetime
-Expires = datetime
-
-
-class AccessDenied(ServiceException):
-    code: str = "AccessDenied"
-    sender_fault: bool = False
-    status_code: int = 403
-    Expires: Expires | None
-    ServerTime: ServerTime | None
-    X_Amz_Expires: X_Amz_Expires | None
-    HostId: HostId | None
-    HeadersNotSigned: HeadersNotSigned | None
-
-
 class AuthorizationQueryParametersError(ServiceException):
     code: str = "AuthorizationQueryParametersError"
     sender_fault: bool = False
@@ -3166,6 +3167,15 @@ class NotificationConfigurationDeprecated(TypedDict, total=False):
     CloudFunctionConfiguration: CloudFunctionConfiguration | None
 
 
+class SSEKMSEncryption(TypedDict, total=False):
+    KMSKeyArn: NonEmptyKmsKeyArnString
+    BucketKeyEnabled: BucketKeyEnabled | None
+
+
+class ObjectEncryption(TypedDict, total=False):
+    SSEKMS: SSEKMSEncryption | None
+
+
 UserMetadata = list[MetadataEntry]
 
 
@@ -3675,6 +3685,21 @@ class UpdateBucketMetadataJournalTableConfigurationRequest(ServiceRequest):
     ExpectedBucketOwner: AccountId | None
 
 
+class UpdateObjectEncryptionRequest(ServiceRequest):
+    Bucket: BucketName
+    Key: ObjectKey
+    VersionId: ObjectVersionId | None
+    ObjectEncryption: ObjectEncryption
+    RequestPayer: RequestPayer | None
+    ExpectedBucketOwner: AccountId | None
+    ContentMD5: ContentMD5 | None
+    ChecksumAlgorithm: ChecksumAlgorithm | None
+
+
+class UpdateObjectEncryptionResponse(TypedDict, total=False):
+    RequestCharged: RequestCharged | None
+
+
 class UploadPartCopyOutput(TypedDict, total=False):
     CopySourceVersionId: CopySourceVersionId | None
     CopyPartResult: CopyPartResult | None
@@ -5305,6 +5330,22 @@ class S3Api:
     ) -> None:
         raise NotImplementedError
 
+    @handler("UpdateObjectEncryption")
+    def update_object_encryption(
+        self,
+        context: RequestContext,
+        bucket: BucketName,
+        key: ObjectKey,
+        object_encryption: ObjectEncryption,
+        version_id: ObjectVersionId | None = None,
+        request_payer: RequestPayer | None = None,
+        expected_bucket_owner: AccountId | None = None,
+        content_md5: ContentMD5 | None = None,
+        checksum_algorithm: ChecksumAlgorithm | None = None,
+        **kwargs,
+    ) -> UpdateObjectEncryptionResponse:
+        raise NotImplementedError
+
     @handler("UploadPart")
     def upload_part(
         self,

{localstack_core-4.13.2.dev4 → localstack_core-4.13.2.dev6}/localstack-core/localstack/aws/api/s3control/__init__.py

@@ -288,6 +288,7 @@ class OperationName(StrEnum):
     S3PutObjectRetention = "S3PutObjectRetention"
     S3ReplicateObject = "S3ReplicateObject"
     S3ComputeObjectChecksum = "S3ComputeObjectChecksum"
+    S3UpdateObjectEncryption = "S3UpdateObjectEncryption"
 
 
 class OutputSchemaVersion(StrEnum):
@@ -1036,6 +1037,19 @@ class JobReport(TypedDict, total=False):
     ExpectedBucketOwner: AccountId | None
 
 
+class S3UpdateObjectEncryptionSSEKMS(TypedDict, total=False):
+    KMSKeyArn: NonEmptyKmsKeyArnString
+    BucketKeyEnabled: Boolean | None
+
+
+class ObjectEncryption(TypedDict, total=False):
+    SSEKMS: S3UpdateObjectEncryptionSSEKMS | None
+
+
+class S3UpdateObjectEncryptionOperation(TypedDict, total=False):
+    ObjectEncryption: ObjectEncryption | None
+
+
 class S3ComputeObjectChecksumOperation(TypedDict, total=False):
     ChecksumAlgorithm: ComputeObjectChecksumAlgorithm | None
     ChecksumType: ComputeObjectChecksumType | None
@@ -1171,6 +1185,7 @@ class JobOperation(TypedDict, total=False):
     S3PutObjectRetention: S3SetObjectRetentionOperation | None
     S3ReplicateObject: S3ReplicateObjectOperation | None
     S3ComputeObjectChecksum: S3ComputeObjectChecksumOperation | None
+    S3UpdateObjectEncryption: S3UpdateObjectEncryptionOperation | None
 
 
 class CreateJobRequest(ServiceRequest):

localstack_core-4.13.2.dev6/localstack-core/localstack/services/s3/headers.py

@@ -0,0 +1,103 @@
+# Code inspired by the standard library ``email.quoprimime.header_encode``, but the safe characters set is different
+# in AWS, so we need to override it
+import unicodedata
+from base64 import b64encode
+from email.errors import HeaderParseError
+from email.header import decode_header as _decode_header
+
+from localstack.utils.strings import to_str
+
+# Build a mapping of octets to the expansion of that octet.  Since we're only
+# going to have 256 of these things, this isn't terribly inefficient
+# space-wise. Initialize the map with the full expansion, and then override
+# the safe bytes with the more compact form.
+_QUOPRI_HEADER_MAP = [f"={c:02X}" for c in range(256)]
+
+_SAFE_HEADERS_CHARS = b"!\"#$%&'()*+,-./0123456789:;<>@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^`abcdefghijklmnopqrstuvwxyz{|}~\t"
+_NO_ENCODING_CHARS = _SAFE_HEADERS_CHARS + b" _=?"
+
+# For AWS, it seems it uses the std lib "safe body" bytes list which need no encoding.
+for c in _SAFE_HEADERS_CHARS:
+    _QUOPRI_HEADER_MAP[c] = chr(c)
+
+# Headers have one other special encoding; spaces become underscores.
+_QUOPRI_HEADER_MAP[ord(" ")] = "_"
+
+
+def encode_header_rfc2047(header: str | None) -> str | None:
+    if header is None:
+        return None
+
+    header_bytes = header.encode("utf-8")
+    # When all chars are "safe chars" plus " " and "_", AWS returns it as is.
+    # But if " " and "_" are presented in an encoded header, it will encode them as well
+    if all(c in _NO_ENCODING_CHARS for c in header_bytes):
+        return header
+
+    if "�" in header or any(unicodedata.category(c).startswith("C") for c in header):
+        # if there are any character which cannot be printed (not a symbol, but will be escaped with \xNN), we need to
+        # base64 encode the header
+        # See https://www.unicode.org/reports/tr44/tr44-34.html#General_Category_Values
+        encoder = encoder_header_rfc2047_base64
+    else:
+        encoder = encode_header_rfc2047_quote_printable
+
+    return encoder(header_bytes)
+
+
+def encode_header_rfc2047_quote_printable(header_bytes: bytes) -> str:
+    """
+    Encode the header value in an RFC 2047 Quote-printable format. By default, Python would encode it in Base64, but
+    AWS encodes it in the QP (a format similar to Quoted-printable, but used for emails).
+    This is the same as the standard library ``email.quoprimime.header_encode``, used by ``email.header.Header`` and
+    ``email.charset.Charset``, but the list of safe characters that do not need to be encoded is different and not
+    overridable.
+
+    See:
+    - https://www.rfc-editor.org/rfc/rfc2047.html
+    - https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingMetadata.html#UserMetadata
+    :param header_bytes: header byte value, UTF-8-encoded
+    :return: encoded header value in RFC 2047 Quoted-printable format
+    """
+    # we use our own safe character map here
+    encoded = header_bytes.decode("latin1").translate(_QUOPRI_HEADER_MAP)
+    return f"=?UTF-8?Q?{encoded}?="
+
+
+def encoder_header_rfc2047_base64(header_bytes: bytes) -> str:
+    encoded = b64encode(header_bytes).decode("ascii")
+    return f"=?UTF-8?B?{encoded}?="
+
+
+def decode_header_rfc2047(header: str) -> str:
+    try:
+        header_parts = _decode_header(header)
+        return "".join(to_str(part, charset) for part, charset in header_parts)
+    except HeaderParseError:
+        if header.lower().startswith("=?utf-8?b?"):
+            # if the header is badly B64 encoded, AWS will return random data, which we cannot make sense of.
+            # we can use the Unicode replacement character instead to indicate an error
+            # we return as many replacement chars as there are b64 chars
+            replacement_header = "\ufffd" * (len(header) - 13)
+            return replacement_header
+        return header
+
+
+def replace_non_iso_8859_1_characters(header: str, repl: str = " ") -> str:
+    """
+    Sanitize the header value to not contain any character which cannot be encoded to latin-1, to be compatible with
+    webservers.
+    :param header: header value, UTF-8 encoded
+    :param repl: replacement value for latin-1 incompatible char, empty space by default in AWS
+    :return: sanitized header value which can be encoded as latin-1
+    """
+    sanitized_header = header
+    while True:
+        try:
+            sanitized_header.encode("iso-8859-1", errors="strict")
+            break
+        except UnicodeEncodeError as exc:
+            bad_char = sanitized_header[exc.start : exc.end]
+            sanitized_header = sanitized_header.replace(bad_char, repl)
+
+    return sanitized_header

{localstack_core-4.13.2.dev4 → localstack_core-4.13.2.dev6}/localstack-core/localstack/services/s3/models.py

@@ -77,6 +77,7 @@ from localstack.services.s3.constants import (
     S3_UPLOAD_PART_MIN_SIZE,
 )
 from localstack.services.s3.exceptions import InvalidRequest
+from localstack.services.s3.headers import replace_non_iso_8859_1_characters
 from localstack.services.s3.utils import (
     CombinedCrcHash,
     get_s3_checksum,
@@ -318,9 +319,7 @@ class S3Object:
         owner: Owner | None = None,
     ):
         self.key = key
-        self.user_metadata = (
-            {k.lower(): v for k, v in user_metadata.items()} if user_metadata else {}
-        )
+        self.user_metadata = user_metadata or {}
         self.system_metadata = system_metadata or {}
         self.version_id = version_id
         self.storage_class = storage_class or StorageClass.STANDARD
@@ -348,6 +347,7 @@ class S3Object:
         self.internal_last_modified = 0
 
     def get_system_metadata_fields(self) -> dict:
+        # TODO: change when updating the schema -> make it a property
         headers = {
             "LastModified": self.last_modified_rfc1123,
             "ContentLength": str(self.size),
@@ -357,7 +357,7 @@ class S3Object:
             headers["Expires"] = self.expires_rfc1123
 
         for metadata_key, metadata_value in self.system_metadata.items():
-            headers[metadata_key] = metadata_value
+            headers[metadata_key] = replace_non_iso_8859_1_characters(metadata_value)
 
         if self.storage_class != StorageClass.STANDARD:
             headers["StorageClass"] = self.storage_class

{localstack_core-4.13.2.dev4 → localstack_core-4.13.2.dev6}/localstack-core/localstack/services/s3/provider.py

@@ -275,6 +275,8 @@ from localstack.services.s3.utils import (
     base_64_content_md5_to_etag,
     create_redirect_for_post_request,
     create_s3_kms_managed_key_for_region,
+    decode_user_metadata,
+    encode_user_metadata,
     etag_to_base_64_content_md5,
     extract_bucket_key_version_id_from_copy_source,
     generate_safe_version_id,
@@ -293,6 +295,8 @@ from localstack.services.s3.utils import (
     get_s3_checksum_algorithm_from_trailing_headers,
     get_system_metadata_from_request,
     get_unique_key_id,
+    get_url_encoded_object_location,
+    header_name_from_capitalized_param,
     is_bucket_name_valid,
     is_version_older_than_other,
     parse_copy_source_range_header,
@@ -760,6 +764,8 @@ class S3Provider(S3Api, ServiceLifecycleHook):
         if not system_metadata.get("ContentType"):
             system_metadata["ContentType"] = "binary/octet-stream"
 
+        user_metadata = decode_user_metadata(request.get("Metadata"))
+
         version_id = generate_version_id(s3_bucket.versioning_status)
         if version_id != "null":
             # if we are in a versioned bucket, we need to lock around the full key (all the versions)
@@ -810,7 +816,7 @@ class S3Provider(S3Api, ServiceLifecycleHook):
             version_id=version_id,
             storage_class=storage_class,
             expires=request.get("Expires"),
-            user_metadata=request.get("Metadata"),
+            user_metadata=user_metadata,
             system_metadata=system_metadata,
             checksum_algorithm=checksum_algorithm,
             checksum_value=checksum_value,
@@ -1015,7 +1021,7 @@ class S3Provider(S3Api, ServiceLifecycleHook):
             **s3_object.get_system_metadata_fields(),
         )
         if s3_object.user_metadata:
-            response["Metadata"] = s3_object.user_metadata
+            response["Metadata"] = encode_user_metadata(s3_object.user_metadata)
 
         if s3_object.parts and request.get("PartNumber"):
             response["PartsCount"] = len(s3_object.parts)
@@ -1097,6 +1103,17 @@ class S3Provider(S3Api, ServiceLifecycleHook):
 
         for request_param, response_param in ALLOWED_HEADER_OVERRIDES.items():
             if request_param_value := request.get(request_param):
+                if isinstance(request_param_value, str):
+                    try:
+                        request_param_value.encode("latin-1")
+                    except UnicodeEncodeError:
+                        raise InvalidArgument(
+                            "Header value cannot be represented using ISO-8859-1.",
+                            ArgumentName=header_name_from_capitalized_param(request_param),
+                            ArgumentValue=request_param_value,
+                            HostId=S3_HOST_ID,
+                        )
+
                 response[response_param] = request_param_value
 
         return response
@@ -1143,7 +1160,7 @@ class S3Provider(S3Api, ServiceLifecycleHook):
             **s3_object.get_system_metadata_fields(),
         )
         if s3_object.user_metadata:
-            response["Metadata"] = s3_object.user_metadata
+            response["Metadata"] = encode_user_metadata(s3_object.user_metadata)
 
         checksum_value = None
         checksum_type = None
@@ -1581,7 +1598,7 @@ class S3Provider(S3Api, ServiceLifecycleHook):
             tagging = parse_tagging_header(tagging)
 
         if metadata_directive == "REPLACE":
-            user_metadata = request.get("Metadata")
+            user_metadata = decode_user_metadata(request.get("Metadata"))
             system_metadata = get_system_metadata_from_request(request)
             if not system_metadata.get("ContentType"):
                 system_metadata["ContentType"] = "binary/octet-stream"
@@ -2284,6 +2301,8 @@ class S3Provider(S3Api, ServiceLifecycleHook):
         if not system_metadata.get("ContentType"):
             system_metadata["ContentType"] = "binary/octet-stream"
 
+        user_metadata = decode_user_metadata(request.get("Metadata"))
+
         checksum_algorithm = request.get("ChecksumAlgorithm")
         if checksum_algorithm and checksum_algorithm not in CHECKSUM_ALGORITHMS:
             raise InvalidRequest(
@@ -2337,7 +2356,7 @@ class S3Provider(S3Api, ServiceLifecycleHook):
             key=key,
             storage_class=storage_class,
             expires=request.get("Expires"),
-            user_metadata=request.get("Metadata"),
+            user_metadata=user_metadata,
             system_metadata=system_metadata,
             checksum_algorithm=checksum_algorithm,
             checksum_type=checksum_type,
@@ -2807,7 +2826,7 @@ class S3Provider(S3Api, ServiceLifecycleHook):
             Bucket=bucket,
             Key=key,
             ETag=s3_object.quoted_etag,
-            Location=f"{get_full_default_bucket_location(bucket)}{key}",
+            Location=get_url_encoded_object_location(bucket, key),
         )
 
         if s3_object.version_id:
@@ -4471,7 +4490,8 @@ class S3Provider(S3Api, ServiceLifecycleHook):
         system_metadata = {}
         for system_metadata_field in post_system_settable_headers:
             if field_value := form.get(system_metadata_field):
-                system_metadata[system_metadata_field.replace("-", "")] = field_value
+                system_key = system_metadata_field.replace("-", "")
+                system_metadata[system_key] = field_value
 
         if not system_metadata.get("ContentType"):
             system_metadata["ContentType"] = "binary/octet-stream"
@@ -4577,7 +4597,8 @@ class S3Provider(S3Api, ServiceLifecycleHook):
             response["StatusCode"] = 204
 
         response["LocationHeader"] = response.get(
-            "LocationHeader", f"{get_full_default_bucket_location(bucket)}{object_key}"
+            "LocationHeader",
+            get_url_encoded_object_location(bucket, object_key),
         )
 
         if s3_bucket.versioning_status == "Enabled":

{localstack_core-4.13.2.dev4 → localstack_core-4.13.2.dev6}/localstack-core/localstack/services/s3/utils.py

@@ -77,6 +77,7 @@ from localstack.services.s3.exceptions import (
     InvalidRequest,
     MalformedXML,
 )
+from localstack.services.s3.headers import decode_header_rfc2047, encode_header_rfc2047
 from localstack.utils.aws import arns
 from localstack.utils.aws.arns import parse_arn
 from localstack.utils.objects import singleton_factory
@@ -462,6 +463,10 @@ def get_full_default_bucket_location(bucket_name: BucketName) -> str:
         return f"{config.get_protocol()}://{bucket_name}.s3.{host_definition.host_and_port()}/"
 
 
+def get_url_encoded_object_location(bucket_name: BucketName, object_key: str) -> str:
+    return f"{get_full_default_bucket_location(bucket_name)}{urlparser.quote(object_key)}"
+
+
 def etag_to_base_64_content_md5(etag: ETag) -> str:
     """
     Convert an ETag, representing a MD5 hexdigest (might be quoted), to its base64 encoded representation
@@ -560,6 +565,20 @@ def get_system_metadata_from_request(request: dict) -> Metadata:
     return metadata
 
 
+def encode_user_metadata(metadata: Metadata) -> Metadata:
+    """Encode the user metadata in the RFC 2047 format if necessary so that it can be returned in HTTP headers"""
+    return {k: encode_header_rfc2047(v) for k, v in metadata.items()}
+
+
+def decode_user_metadata(metadata: Metadata | None) -> Metadata:
+    """Decode the user metadata if provided in the RFC2047 format, or leave as is if not. AWS also lowercase the
+    metadata key"""
+    if not metadata:
+        return {}
+
+    return {k.lower(): decode_header_rfc2047(v) for k, v in metadata.items()}
+
+
 def extract_bucket_name_and_key_from_headers_and_path(
     headers: dict[str, str], path: str
 ) -> tuple[str | None, str | None]:
@@ -618,6 +637,10 @@ def capitalize_header_name_from_snake_case(header_name: str) -> str:
     return "-".join([part.capitalize() for part in header_name.split("-")])
 
 
+def header_name_from_capitalized_param(param_name: str) -> str:
+    return "-".join(re.findall("[A-Z][^A-Z]*", param_name)).lower()
+
+
 def get_kms_key_arn(kms_key: str, account_id: str, bucket_region: str) -> str | None:
     """
     In S3, the KMS key can be passed as a KeyId or a KeyArn. This method allows to always get the KeyArn from either.