localstack-core 4.13.2.dev84__tar.gz → 4.13.2.dev91__tar.gz

{localstack_core-4.13.2.dev84 → localstack_core-4.13.2.dev91}/Dockerfile

@@ -78,7 +78,7 @@ RUN chmod 777 . && \
 
 # install the entrypoint script
 ADD bin/docker-entrypoint.sh /usr/local/bin/
-# add the shipped hosts file to prevent performance degredation in windows container mode on windows
+# add the shipped hosts file to prevent performance degradation in windows container mode on windows
 # (where hosts file is not mounted) See https://github.com/localstack/localstack/issues/5178
 ADD bin/hosts /etc/hosts
 

{localstack_core-4.13.2.dev84 → localstack_core-4.13.2.dev91}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: localstack-core
-Version: 4.13.2.dev84
+Version: 4.13.2.dev91
 Summary: The core library and runtime of LocalStack
 Author-email: LocalStack Contributors <info@localstack.cloud>
 License-Expression: Apache-2.0
@@ -29,8 +29,8 @@ Requires-Dist: rich>=12.3.0
 Requires-Dist: requests>=2.20.0
 Requires-Dist: semver>=2.10
 Provides-Extra: base-runtime
-Requires-Dist: boto3==1.42.49; extra == "base-runtime"
-Requires-Dist: botocore==1.42.49; extra == "base-runtime"
+Requires-Dist: boto3==1.42.54; extra == "base-runtime"
+Requires-Dist: botocore==1.42.54; extra == "base-runtime"
 Requires-Dist: awscrt!=0.27.1,>=0.13.14; extra == "base-runtime"
 Requires-Dist: cbor2>=5.5.0; extra == "base-runtime"
 Requires-Dist: dill==0.3.6; extra == "base-runtime"
@@ -53,7 +53,7 @@ Requires-Dist: xmltodict>=0.13.0; extra == "base-runtime"
 Requires-Dist: rolo>=0.8.1; extra == "base-runtime"
 Provides-Extra: runtime
 Requires-Dist: localstack-core[base-runtime]; extra == "runtime"
-Requires-Dist: awscli==1.44.39; extra == "runtime"
+Requires-Dist: awscli==1.44.44; extra == "runtime"
 Requires-Dist: airspeed-ext>=0.6.3; extra == "runtime"
 Requires-Dist: antlr4-python3-runtime==4.13.2; extra == "runtime"
 Requires-Dist: apispec>=5.1.1; extra == "runtime"

{localstack_core-4.13.2.dev84 → localstack_core-4.13.2.dev91}/localstack-core/localstack/aws/api/ec2/__init__.py

@@ -10071,6 +10071,7 @@ class CreatePlacementGroupRequest(ServiceRequest):
     TagSpecifications: TagSpecificationList | None
     SpreadLevel: SpreadLevel | None
     LinkedGroupId: PlacementGroupId | None
+    Operator: OperatorRequest | None
     DryRun: Boolean | None
     GroupName: String | None
     Strategy: PlacementStrategy | None
@@ -10086,6 +10087,7 @@ class PlacementGroup(TypedDict, total=False):
     GroupArn: String | None
     SpreadLevel: SpreadLevel | None
     LinkedGroupId: PlacementGroupId | None
+    Operator: OperatorResponse | None
 
 
 class CreatePlacementGroupResult(TypedDict, total=False):
@@ -24750,6 +24752,7 @@ class Ec2Api:
         tag_specifications: TagSpecificationList | None = None,
         spread_level: SpreadLevel | None = None,
         linked_group_id: PlacementGroupId | None = None,
+        operator: OperatorRequest | None = None,
         dry_run: Boolean | None = None,
         group_name: String | None = None,
         strategy: PlacementStrategy | None = None,

{localstack_core-4.13.2.dev84 → localstack_core-4.13.2.dev91}/localstack-core/localstack/aws/api/kms/__init__.py

@@ -123,6 +123,10 @@ class DataKeySpec(StrEnum):
     AES_128 = "AES_128"
 
 
+class DryRunModifierType(StrEnum):
+    IGNORE_CIPHERTEXT = "IGNORE_CIPHERTEXT"
+
+
 class EncryptionAlgorithmSpec(StrEnum):
     SYMMETRIC_DEFAULT = "SYMMETRIC_DEFAULT"
     RSAES_OAEP_SHA_1 = "RSAES_OAEP_SHA_1"
@@ -767,6 +771,7 @@ class CustomKeyStoresListEntry(TypedDict, total=False):
 
 
 CustomKeyStoresList = list[CustomKeyStoresListEntry]
+DryRunModifierList = list[DryRunModifierType]
 
 
 class RecipientInfo(TypedDict, total=False):
@@ -775,13 +780,14 @@ class RecipientInfo(TypedDict, total=False):
 
 
 class DecryptRequest(ServiceRequest):
-    CiphertextBlob: CiphertextType
+    CiphertextBlob: CiphertextType | None
     EncryptionContext: EncryptionContextType | None
     GrantTokens: GrantTokenList | None
     KeyId: KeyIdType | None
     EncryptionAlgorithm: EncryptionAlgorithmSpec | None
     Recipient: RecipientInfo | None
     DryRun: NullableBooleanType | None
+    DryRunModifiers: DryRunModifierList | None
 
 
 PlaintextType = bytes
@@ -1188,7 +1194,7 @@ class PutKeyPolicyRequest(ServiceRequest):
 
 
 class ReEncryptRequest(ServiceRequest):
-    CiphertextBlob: CiphertextType
+    CiphertextBlob: CiphertextType | None
     SourceEncryptionContext: EncryptionContextType | None
     SourceKeyId: KeyIdType | None
     DestinationKeyId: KeyIdType
@@ -1197,6 +1203,7 @@ class ReEncryptRequest(ServiceRequest):
     DestinationEncryptionAlgorithm: EncryptionAlgorithmSpec | None
     GrantTokens: GrantTokenList | None
     DryRun: NullableBooleanType | None
+    DryRunModifiers: DryRunModifierList | None
 
 
 class ReEncryptResponse(TypedDict, total=False):
@@ -1428,13 +1435,14 @@ class KmsApi:
     def decrypt(
         self,
         context: RequestContext,
-        ciphertext_blob: CiphertextType,
+        ciphertext_blob: CiphertextType | None = None,
         encryption_context: EncryptionContextType | None = None,
         grant_tokens: GrantTokenList | None = None,
         key_id: KeyIdType | None = None,
         encryption_algorithm: EncryptionAlgorithmSpec | None = None,
         recipient: RecipientInfo | None = None,
         dry_run: NullableBooleanType | None = None,
+        dry_run_modifiers: DryRunModifierList | None = None,
         **kwargs,
     ) -> DecryptResponse:
         raise NotImplementedError
@@ -1765,8 +1773,8 @@ class KmsApi:
     def re_encrypt(
         self,
         context: RequestContext,
-        ciphertext_blob: CiphertextType,
         destination_key_id: KeyIdType,
+        ciphertext_blob: CiphertextType | None = None,
         source_encryption_context: EncryptionContextType | None = None,
         source_key_id: KeyIdType | None = None,
         destination_encryption_context: EncryptionContextType | None = None,
@@ -1774,6 +1782,7 @@ class KmsApi:
         destination_encryption_algorithm: EncryptionAlgorithmSpec | None = None,
         grant_tokens: GrantTokenList | None = None,
         dry_run: NullableBooleanType | None = None,
+        dry_run_modifiers: DryRunModifierList | None = None,
         **kwargs,
     ) -> ReEncryptResponse:
         raise NotImplementedError

{localstack_core-4.13.2.dev84 → localstack_core-4.13.2.dev91}/localstack-core/localstack/aws/api/ssm/__init__.py

@@ -21,6 +21,7 @@ AllowedPattern = str
 ApplyOnlyAtCronInterval = bool
 ApproveAfterDays = int
 Architecture = str
+AssociationDispatchAssumeRoleArn = str
 AssociationExecutionFilterValue = str
 AssociationExecutionId = str
 AssociationExecutionTargetsFilterValue = str
@@ -2214,6 +2215,7 @@ class AssociationDescription(TypedDict, total=False):
     TargetMaps: TargetMaps | None
     AlarmConfiguration: AlarmConfiguration | None
     TriggeredAlarms: AlarmStateInformationList | None
+    AssociationDispatchAssumeRole: AssociationDispatchAssumeRoleArn | None
 
 
 AssociationDescriptionList = list[AssociationDescription]
@@ -2299,6 +2301,7 @@ class AssociationVersionInfo(TypedDict, total=False):
     ScheduleOffset: ScheduleOffset | None
     Duration: Duration | None
     TargetMaps: TargetMaps | None
+    AssociationDispatchAssumeRole: AssociationDispatchAssumeRoleArn | None
 
 
 AssociationVersionList = list[AssociationVersionInfo]
@@ -2823,6 +2826,7 @@ CreateAssociationBatchRequestEntries = list[CreateAssociationBatchRequestEntry]
 
 class CreateAssociationBatchRequest(ServiceRequest):
     Entries: CreateAssociationBatchRequestEntries
+    AssociationDispatchAssumeRole: AssociationDispatchAssumeRoleArn | None
 
 
 class FailedCreateAssociation(TypedDict, total=False):
@@ -2861,6 +2865,7 @@ class CreateAssociationRequest(ServiceRequest):
     TargetMaps: TargetMaps | None
     Tags: TagList | None
     AlarmConfiguration: AlarmConfiguration | None
+    AssociationDispatchAssumeRole: AssociationDispatchAssumeRoleArn | None
 
 
 class CreateAssociationResult(TypedDict, total=False):
@@ -5747,6 +5752,7 @@ class UpdateAssociationRequest(ServiceRequest):
     Duration: Duration | None
     TargetMaps: TargetMaps | None
     AlarmConfiguration: AlarmConfiguration | None
+    AssociationDispatchAssumeRole: AssociationDispatchAssumeRoleArn | None
 
 
 class UpdateAssociationResult(TypedDict, total=False):
@@ -6062,13 +6068,18 @@ class SsmApi:
         target_maps: TargetMaps | None = None,
         tags: TagList | None = None,
         alarm_configuration: AlarmConfiguration | None = None,
+        association_dispatch_assume_role: AssociationDispatchAssumeRoleArn | None = None,
         **kwargs,
     ) -> CreateAssociationResult:
         raise NotImplementedError
 
     @handler("CreateAssociationBatch")
     def create_association_batch(
-        self, context: RequestContext, entries: CreateAssociationBatchRequestEntries, **kwargs
+        self,
+        context: RequestContext,
+        entries: CreateAssociationBatchRequestEntries,
+        association_dispatch_assume_role: AssociationDispatchAssumeRoleArn | None = None,
+        **kwargs,
     ) -> CreateAssociationBatchResult:
         raise NotImplementedError
 
@@ -7478,6 +7489,7 @@ class SsmApi:
         duration: Duration | None = None,
         target_maps: TargetMaps | None = None,
         alarm_configuration: AlarmConfiguration | None = None,
+        association_dispatch_assume_role: AssociationDispatchAssumeRoleArn | None = None,
         **kwargs,
     ) -> UpdateAssociationResult:
         raise NotImplementedError

{localstack_core-4.13.2.dev84 → localstack_core-4.13.2.dev91}/localstack-core/localstack/services/kms/provider.py

@@ -36,6 +36,7 @@ from localstack.aws.api.kms import (
     DisabledException,
     DisableKeyRequest,
     DisableKeyRotationRequest,
+    DryRunModifierList,
     EnableKeyRequest,
     EnableKeyRotationRequest,
     EncryptionAlgorithmSpec,
@@ -993,15 +994,16 @@ class KmsProvider(KmsApi, ServiceLifecycleHook):
     def re_encrypt(
         self,
         context: RequestContext,
-        ciphertext_blob: CiphertextType,
         destination_key_id: KeyIdType,
-        source_encryption_context: EncryptionContextType = None,
-        source_key_id: KeyIdType = None,
-        destination_encryption_context: EncryptionContextType = None,
-        source_encryption_algorithm: EncryptionAlgorithmSpec = None,
-        destination_encryption_algorithm: EncryptionAlgorithmSpec = None,
-        grant_tokens: GrantTokenList = None,
-        dry_run: NullableBooleanType = None,
+        ciphertext_blob: CiphertextType | None = None,
+        source_encryption_context: EncryptionContextType | None = None,
+        source_key_id: KeyIdType | None = None,
+        destination_encryption_context: EncryptionContextType | None = None,
+        source_encryption_algorithm: EncryptionAlgorithmSpec | None = None,
+        destination_encryption_algorithm: EncryptionAlgorithmSpec | None = None,
+        grant_tokens: GrantTokenList | None = None,
+        dry_run: NullableBooleanType | None = None,
+        dry_run_modifiers: DryRunModifierList | None = None,
         **kwargs,
     ) -> ReEncryptResponse:
         # TODO: when implementing, ensure cross-account support for source_key_id and destination_key_id
@@ -1071,13 +1073,14 @@ class KmsProvider(KmsApi, ServiceLifecycleHook):
     def decrypt(
         self,
         context: RequestContext,
-        ciphertext_blob: CiphertextType,
-        encryption_context: EncryptionContextType = None,
-        grant_tokens: GrantTokenList = None,
-        key_id: KeyIdType = None,
-        encryption_algorithm: EncryptionAlgorithmSpec = None,
-        recipient: RecipientInfo = None,
-        dry_run: NullableBooleanType = None,
+        ciphertext_blob: CiphertextType | None = None,
+        encryption_context: EncryptionContextType | None = None,
+        grant_tokens: GrantTokenList | None = None,
+        key_id: KeyIdType | None = None,
+        encryption_algorithm: EncryptionAlgorithmSpec | None = None,
+        recipient: RecipientInfo | None = None,
+        dry_run: NullableBooleanType | None = None,
+        dry_run_modifiers: DryRunModifierList | None = None,
         **kwargs,
     ) -> DecryptResponse:
         # In AWS, key_id is only supplied for data encrypted with an asymmetrical algorithm. For symmetrical

{localstack_core-4.13.2.dev84 → localstack_core-4.13.2.dev91}/localstack-core/localstack/services/lambda_/invocation/assignment.py

@@ -148,7 +148,7 @@ class AssignmentService(OtherServiceEndpoint):
         # current_provisioned_environments_count = len(current_provisioned_environments)
         # diff = target_provisioned_environments - current_provisioned_environments_count
 
-        # TODO: handle case where no provisioned environment is available during scaling
+        # TODO: handle case where no provisioned environment is available during scaling. Does AWS serve on-demand?
         # Most simple scaling implementation for now:
         futures = []
         # 1) Re-create new target

{localstack_core-4.13.2.dev84 → localstack_core-4.13.2.dev91}/localstack-core/localstack/services/lambda_/invocation/counting_service.py

@@ -5,11 +5,12 @@ from collections.abc import Iterator
 from threading import RLock
 
 from localstack import config
-from localstack.aws.api.lambda_ import TooManyRequestsException
+from localstack.aws.api.lambda_ import ProvisionedConcurrencyStatusEnum, TooManyRequestsException
 from localstack.services.lambda_.invocation.lambda_models import (
     Function,
     FunctionVersion,
     InitializationType,
+    ProvisionedConcurrencyState,
 )
 from localstack.services.lambda_.invocation.models import lambda_stores
 
@@ -84,7 +85,10 @@ class CountingService:
 
     @contextlib.contextmanager
     def get_invocation_lease(
-        self, function: Function | None, function_version: FunctionVersion
+        self,
+        function: Function | None,
+        function_version: FunctionVersion,
+        provisioned_state: ProvisionedConcurrencyState | None = None,
     ) -> Iterator[InitializationType]:
         """An invocation lease reserves the right to schedule an invocation.
         The returned lease type can either be on-demand or provisioned.
@@ -118,13 +122,6 @@ class CountingService:
                         ConcurrencyTracker()
                     )
 
-        # TODO: check that we don't give a lease while updating provisioned concurrency
-        # Potential challenge if an update happens in between reserving the lease here and actually assigning
-        # * Increase provisioned: It could happen that we give a lease for provisioned-concurrency although
-        # brand new provisioned environments are not yet initialized.
-        # * Decrease provisioned: It could happen that we have running invocations that should still be counted
-        # against the limit but they are not because we already updated the concurrency config to fewer envs.
-
         unqualified_function_arn = function_version.id.unqualified_arn()
         qualified_arn = function_version.id.qualified_arn()
 
@@ -145,7 +142,17 @@ class CountingService:
                                 function.provisioned_concurrency_configs.get(alias.name)
                             )
                             break
-                if provisioned_concurrency_config:
+                # Favor provisioned concurrency if configured and ready
+                # TODO: test updating provisioned concurrency? Does AWS serve on-demand during updates?
+                # Potential challenge if an update happens in between reserving the lease here and actually assigning
+                # * Increase provisioned: It could happen that we give a lease for provisioned-concurrency although
+                # brand new provisioned environments are not yet initialized.
+                # * Decrease provisioned: It could happen that we have running invocations that should still be counted
+                # against the limit but they are not because we already updated the concurrency config to fewer envs.
+                if (
+                    provisioned_concurrency_config
+                    and provisioned_state.status == ProvisionedConcurrencyStatusEnum.READY
+                ):
                     available_provisioned_concurrency = (
                         provisioned_concurrency_config.provisioned_concurrent_executions
                         - provisioned_tracker.concurrent_executions[qualified_arn]

{localstack_core-4.13.2.dev84 → localstack_core-4.13.2.dev91}/localstack-core/localstack/services/lambda_/invocation/lambda_service.py

@@ -56,7 +56,7 @@ from localstack.services.lambda_.invocation.lambda_models import (
     VersionAlias,
     VersionState,
 )
-from localstack.services.lambda_.invocation.models import lambda_stores
+from localstack.services.lambda_.invocation.models import LambdaStore, lambda_stores
 from localstack.services.lambda_.invocation.version_manager import LambdaVersionManager
 from localstack.services.lambda_.lambda_utils import HINT_LOG
 from localstack.utils.archives import get_unzipped_size, is_zip_file
@@ -196,6 +196,66 @@ class LambdaService:
     def publish_version_async(self, function_version: FunctionVersion):
         self.task_executor.submit(self.publish_version, function_version)
 
+    def delete_function_version_async(
+        self, function: Function, version: FunctionVersion, qualifier: str
+    ):
+        """
+        Simulates async function cleanup after function deletion API is called
+        by introducing a small delay before actually removing the function from the store
+        to allow for getting the function details after deletion.
+        """
+
+        def _cleanup():
+            time.sleep(0.5)
+            function.versions.pop(qualifier, None)
+
+        new_state = VersionState(state=State.Deleting)
+        new_last_status = UpdateStatus(status=LastUpdateStatus.InProgress)
+        function.versions[version.id.qualifier] = dataclasses.replace(
+            version,
+            config=dataclasses.replace(
+                version.config, state=new_state, last_update=new_last_status
+            ),
+        )
+        destroy_code_if_not_used(code=version.config.code, function=function)
+
+        self.task_executor.submit(_cleanup)
+
+    def delete_function_async(self, store: LambdaStore, function_name: str):
+        """
+        Simulates async function version cleanup after function deletion API is called
+        by introducing a small delay before actually removing the function from the store
+        to allow for getting the function version details after deletion.
+        """
+
+        def _cleanup():
+            time.sleep(0.5)
+            store.functions.pop(function_name)
+
+        # set each version of the function to deleting state first, to allow for getting the function version details after deletion
+        function = store.functions.get(function_name)
+        if function:
+            for version in function.versions.values():
+                new_state = VersionState(state=State.Deleting)
+                new_last_status = UpdateStatus(status=LastUpdateStatus.InProgress)
+                previous_revision_id = version.config.revision_id
+
+                function.versions[version.id.qualifier] = dataclasses.replace(
+                    version,
+                    config=dataclasses.replace(
+                        version.config, state=new_state, last_update=new_last_status
+                    ),
+                )
+                # Seems the revision id doesn't change when deleting a function right after it has been created (even though state has changed)
+                # reassign revision id to avoid dataclass replace removing it, since it's init=False
+                object.__setattr__(
+                    function.versions[version.id.qualifier].config,
+                    "revision_id",
+                    previous_revision_id,
+                )
+
+        self.task_executor.submit(_cleanup)
+
     def publish_version(self, function_version: FunctionVersion):
         """
         Synchronously create a function version (manager)

{localstack_core-4.13.2.dev84 → localstack_core-4.13.2.dev91}/localstack-core/localstack/services/lambda_/invocation/version_manager.py

@@ -3,7 +3,7 @@ import logging
 import threading
 import time
 from concurrent.futures import Future
-from concurrent.futures._base import CancelledError
+from concurrent.futures._base import ALL_COMPLETED, CancelledError
 
 from localstack import config
 from localstack.aws.api.lambda_ import (
@@ -79,10 +79,10 @@ class LambdaVersionManager:
         self.shutdown_event = threading.Event()
 
         # async state
-        self.provisioned_state = None
+        self.provisioned_state: ProvisionedConcurrencyState | None = None
         self.provisioned_state_lock = threading.RLock()
         # https://aws.amazon.com/blogs/compute/coming-soon-expansion-of-aws-lambda-states-to-all-functions/
-        self.state = VersionState(state=State.Pending)
+        self.state: VersionState = VersionState(state=State.Pending)
 
         self.ldm_provisioner = None
         lambda_hooks.inject_ldm_provisioner.run(self)
@@ -153,8 +153,6 @@ class LambdaVersionManager:
         TODO: implement update while in progress (see test_provisioned_concurrency test)
         TODO: loop until diff == 0 and retry to remove/add diff environments
         TODO: alias routing & allocated (i.e., the status while updating provisioned concurrency)
-        TODO: ProvisionedConcurrencyStatusEnum.FAILED
-        TODO: status reason
 
         :param provisioned_concurrent_executions: set to 0 to stop all provisioned environments
         """
@@ -175,16 +173,37 @@ class LambdaVersionManager:
             futures = self.assignment_service.scale_provisioned_concurrency(
                 self.id, self.function_version, provisioned_concurrent_executions
             )
+            # Wait for all provisioning/de-provisioning tasks to finish using a timeout longer than max Lambda execution
+            concurrent.futures.wait(futures, timeout=20 * 60, return_when=ALL_COMPLETED)
 
-            concurrent.futures.wait(futures)
+            success_count = 0
+            start_error = None
+            for i, future in enumerate(futures):
+                try:
+                    future.result()
+                    success_count += 1
+                except Exception as e:
+                    start_error = e
 
             with self.provisioned_state_lock:
                 if provisioned_concurrent_executions == 0:
                     self.provisioned_state = None
                 else:
-                    self.provisioned_state.available = provisioned_concurrent_executions
-                    self.provisioned_state.allocated = provisioned_concurrent_executions
-                    self.provisioned_state.status = ProvisionedConcurrencyStatusEnum.READY
+                    # TODO: check whether available changes with active invokes while updating
+                    self.provisioned_state.available = success_count
+                    self.provisioned_state.allocated = success_count
+                    if start_error or success_count < provisioned_concurrent_executions:
+                        self.provisioned_state.status = ProvisionedConcurrencyStatusEnum.FAILED
+                        self.provisioned_state.status_reason = "FUNCTION_ERROR_INIT_FAILURE"
+                        LOG.warning(
+                            "Failed to provision %d/%s environments for function %s. Error: %s",
+                            provisioned_concurrent_executions - success_count,
+                            provisioned_concurrent_executions,
+                            self.function_arn,
+                            start_error,
+                        )
+                    else:
+                        self.provisioned_state.status = ProvisionedConcurrencyStatusEnum.READY
 
         self.provisioning_thread = start_thread(scale_environments)
         return self.provisioning_thread.result_future
@@ -255,7 +274,7 @@ class LambdaVersionManager:
             return invocation_result
 
         with self.counting_service.get_invocation_lease(
-            self.function, self.function_version
+            self.function, self.function_version, self.provisioned_state
         ) as provisioning_type:
             # TODO: potential race condition when changing provisioned concurrency after getting the lease but before
             #   getting an environment

{localstack_core-4.13.2.dev84 → localstack_core-4.13.2.dev91}/localstack-core/localstack/services/lambda_/provider.py

@@ -1638,10 +1638,14 @@ class LambdaProvider(LambdaApi, ServiceLifecycleHook):
         function_has_capacity_provider = False
         if qualifier:
             # delete a version of the function
-            version = function.versions.pop(qualifier, None)
+            version = function.versions.get(qualifier, None)
             if version:
                 if version.config.capacity_provider_config:
                     function_has_capacity_provider = True
+                    # async delete from store
+                    self.lambda_service.delete_function_version_async(function, version, qualifier)
+                else:
+                    function.versions.pop(qualifier, None)
                 self.lambda_service.stop_version(version.id.qualified_arn())
                 destroy_code_if_not_used(code=version.config.code, function=function)
         else:
@@ -1649,19 +1653,24 @@ class LambdaProvider(LambdaApi, ServiceLifecycleHook):
             self._remove_all_tags(unqualified_function_arn)
             # TODO: introduce locking for safe deletion: We could create a new version at the API layer before
             #  the old version gets cleaned up in the internal lambda service.
-            function = store.functions.pop(function_name)
+            function = store.functions.get(function_name)
+            if function.latest().config.capacity_provider_config:
+                function_has_capacity_provider = True
+                # async delete version from store
+                self.lambda_service.delete_function_async(store, function_name)
+
             for version in function.versions.values():
                 # Functions with a capacity provider do NOT have a version manager for $LATEST because only
                 # published versions are invokable.
-                if version.config.capacity_provider_config:
-                    function_has_capacity_provider = True
-                    if version.id.qualifier == "$LATEST":
-                        pass
-                else:
+                if not function_has_capacity_provider or (
+                    function_has_capacity_provider and version.id.qualifier != "$LATEST"
+                ):
                     self.lambda_service.stop_version(qualified_arn=version.id.qualified_arn())
                 # we can safely destroy the code here
                 if version.config.code:
                     version.config.code.destroy()
+            if not function_has_capacity_provider:
+                store.functions.pop(function_name, None)
 
         return DeleteFunctionResponse(StatusCode=202 if function_has_capacity_provider else 204)
 

{localstack_core-4.13.2.dev84 → localstack_core-4.13.2.dev91}/localstack-core/localstack/services/lambda_/resource_providers/lambda_alias.py

@@ -116,7 +116,7 @@ class LambdaAliasProvider(ResourceProvider[LambdaAliasProperties]):
                 return ProgressEvent(
                     status=OperationStatus.FAILED,
                     resource_model=model,
-                    message="",
+                    message=result.get("StatusReason", "Unknown"),
                     error_code="VersionStateFailure",  # TODO: not parity tested
                 )
 

{localstack_core-4.13.2.dev84 → localstack_core-4.13.2.dev91}/localstack-core/localstack/services/s3/provider.py

@@ -1513,6 +1513,25 @@ class S3Provider(S3Api, ServiceLifecycleHook):
         # request_payer: RequestPayer = None,  # TODO:
         dest_bucket = request["Bucket"]
         dest_key = request["Key"]
+
+        if_match = request.get("IfMatch")
+        if_none_match = request.get("IfNoneMatch")
+
+        if if_none_match and if_match:
+            raise NotImplementedException(
+                "A header you provided implies functionality that is not implemented",
+                Header="If-Match,If-None-Match",
+                additionalMessage="Multiple conditional request headers present in the request",
+            )
+
+        elif (if_none_match and if_none_match != "*") or (if_match and if_match == "*"):
+            header_name = "If-None-Match" if if_none_match else "If-Match"
+            raise NotImplementedException(
+                "A header you provided implies functionality that is not implemented",
+                Header=header_name,
+                additionalMessage=f"We don't accept the provided value of {header_name} header for this API",
+            )
+
         validate_object_key(dest_key)
         store, dest_s3_bucket = self._get_cross_account_bucket(context, dest_bucket)
 
@@ -1615,6 +1634,12 @@ class S3Provider(S3Api, ServiceLifecycleHook):
             system_metadata = src_s3_object.system_metadata
 
         dest_version_id = generate_version_id(dest_s3_bucket.versioning_status)
+        if dest_version_id != "null":
+            # if we are in a versioned bucket, we need to lock around the full key (all the versions)
+            # because object versions have locks per version
+            precondition_lock = self._preconditions_locks[dest_bucket][dest_key]
+        else:
+            precondition_lock = contextlib.nullcontext()
 
         encryption_parameters = get_encryption_parameters_from_request_and_bucket(
             request,
@@ -1654,12 +1679,25 @@ class S3Provider(S3Api, ServiceLifecycleHook):
             owner=dest_s3_bucket.owner,
         )
 
-        with self._storage_backend.copy(
-            src_bucket=src_bucket,
-            src_object=src_s3_object,
-            dest_bucket=dest_bucket,
-            dest_object=s3_object,
-        ) as s3_stored_object:
+        with (
+            precondition_lock,
+            self._storage_backend.copy(
+                src_bucket=src_bucket,
+                src_object=src_s3_object,
+                dest_bucket=dest_bucket,
+                dest_object=s3_object,
+            ) as s3_stored_object,
+        ):
+            # Check destination write preconditions inside the lock to prevent race conditions.
+            if if_none_match and object_exists_for_precondition_write(dest_s3_bucket, dest_key):
+                raise PreconditionFailed(
+                    "At least one of the pre-conditions you specified did not hold",
+                    Condition="If-None-Match",
+                )
+
+            elif if_match:
+                verify_object_equality_precondition_write(dest_s3_bucket, dest_key, if_match)
+
             s3_object.checksum_value = s3_stored_object.checksum or src_s3_object.checksum_value
             s3_object.etag = s3_stored_object.etag or src_s3_object.etag
 

{localstack_core-4.13.2.dev84 → localstack_core-4.13.2.dev91}/localstack-core/localstack/testing/aws/lambda_utils.py

@@ -277,6 +277,22 @@ def concurrency_update_done(client, function_name, qualifier):
     return _concurrency_update_done
 
 
+def concurrency_update_failed(client, function_name, qualifier):
+    """wait fn for ProvisionedConcurrencyConfig 'Status'"""
+
+    def _concurrency_update_failed():
+        status = client.get_provisioned_concurrency_config(
+            FunctionName=function_name, Qualifier=qualifier
+        )["Status"]
+        if status == "READY":
+            # We are expecting a failure and short-circuit upon success
+            raise ShortCircuitWaitException(f"Concurrency update succeeded: {status=}")
+        else:
+            return status == "FAILED"
+
+    return _concurrency_update_failed
+
+
 def get_invoke_init_type(client, function_name, qualifier) -> InitializationType:
     """check the environment in the lambda for AWS_LAMBDA_INITIALIZATION_TYPE indicating ondemand/provisioned"""
     invoke_result = client.invoke(FunctionName=function_name, Qualifier=qualifier)