localstack-core 4.7.1.dev139__py3-none-any.whl → 4.10.1.dev42__py3-none-any.whl

localstack/services/iam/resources/policy_simulator.py

@@ -0,0 +1,133 @@
+import abc
+import json
+
+from moto.iam import iam_backends
+from moto.iam.models import IAMBackend
+
+from localstack.aws.api import RequestContext
+from localstack.aws.api.iam import (
+    ActionNameType,
+    EvaluationResult,
+    PolicyEvaluationDecisionType,
+    ResourceNameType,
+    SimulatePolicyResponse,
+    SimulatePrincipalPolicyRequest,
+)
+
+
+class IAMPolicySimulator(abc.ABC):
+    @abc.abstractmethod
+    def simulate_principal_policy(
+        self, context: RequestContext, request: SimulatePrincipalPolicyRequest
+    ) -> SimulatePolicyResponse:
+        """
+        Simulate principal policy
+        :param request: SimulatePrincipalPolicyRequest
+        :param context: RequestContext
+        :return: SimulatePrincipalResponse
+        """
+        pass
+
+
+class BasicIAMPolicySimulator(IAMPolicySimulator):
+    def simulate_principal_policy(
+        self,
+        context: RequestContext,
+        request: SimulatePrincipalPolicyRequest,
+    ) -> SimulatePolicyResponse:
+        backend = self.get_iam_backend(context)
+        policies = self.get_policies_from_principal(backend, request.get("PolicySourceArn"))
+
+        def _get_statements_from_policy_list(_policies: list[str]):
+            statements = []
+            for policy_str in _policies:
+                policy_dict = json.loads(policy_str)
+                if isinstance(policy_dict["Statement"], list):
+                    statements.extend(policy_dict["Statement"])
+                else:
+                    statements.append(policy_dict["Statement"])
+            return statements
+
+        policy_statements = _get_statements_from_policy_list(policies)
+
+        evaluations = [
+            self.build_evaluation_result(action_name, resource_arn, policy_statements)
+            for action_name in request.get("ActionNames")
+            for resource_arn in request.get("ResourceArns")
+        ]
+
+        response = SimulatePolicyResponse()
+        response["IsTruncated"] = False
+        response["EvaluationResults"] = evaluations
+
+        return response
+
+    @staticmethod
+    def build_evaluation_result(
+        action_name: ActionNameType, resource_name: ResourceNameType, policy_statements: list[dict]
+    ) -> EvaluationResult:
+        eval_res = EvaluationResult()
+        eval_res["EvalActionName"] = action_name
+        eval_res["EvalResourceName"] = resource_name
+        eval_res["EvalDecision"] = PolicyEvaluationDecisionType.explicitDeny
+        for statement in policy_statements:
+            # TODO Implement evaluation logic here
+            if (
+                action_name in statement["Action"]
+                and resource_name in statement["Resource"]
+                and statement["Effect"] == "Allow"
+            ):
+                eval_res["EvalDecision"] = PolicyEvaluationDecisionType.allowed
+                eval_res["MatchedStatements"] = []  # TODO: add support for statement compilation.
+        return eval_res
+
+    @staticmethod
+    def get_iam_backend(context: RequestContext) -> IAMBackend:
+        return iam_backends[context.account_id][context.partition]
+
+    @staticmethod
+    def get_policies_from_principal(backend: IAMBackend, principal_arn: str) -> list[dict]:
+        policies = []
+        if ":role" in principal_arn:
+            role_name = principal_arn.split("/")[-1]
+
+            policies.append(backend.get_role(role_name=role_name).assume_role_policy_document)
+
+            policy_names = backend.list_role_policies(role_name=role_name)
+            policies.extend(
+                [
+                    backend.get_role_policy(role_name=role_name, policy_name=policy_name)[1]
+                    for policy_name in policy_names
+                ]
+            )
+
+            attached_policies, _ = backend.list_attached_role_policies(role_name=role_name)
+            policies.extend([policy.document for policy in attached_policies])
+
+        if ":group" in principal_arn:
+            group_name = principal_arn.split("/")[-1]
+            policy_names = backend.list_group_policies(group_name=group_name)
+            policies.extend(
+                [
+                    backend.get_group_policy(group_name=group_name, policy_name=policy_name)[1]
+                    for policy_name in policy_names
+                ]
+            )
+
+            attached_policies, _ = backend.list_attached_group_policies(group_name=group_name)
+            policies.extend([policy.document for policy in attached_policies])
+
+        if ":user" in principal_arn:
+            user_name = principal_arn.split("/")[-1]
+            policy_names = backend.list_user_policies(user_name=user_name)
+            policies.extend(
+                [
+                    backend.get_user_policy(user_name=user_name, policy_name=policy_name)[1]
+                    for policy_name in policy_names
+                ]
+            )
+
+            attached_policies, _ = backend.list_attached_user_policies(user_name=user_name)
+            policies.extend([policy.document for policy in attached_policies])
+
+        return policies

localstack/services/kinesis/models.py

@@ -1,7 +1,18 @@
 from collections import defaultdict
 
-from localstack.aws.api.kinesis import ConsumerDescription, MetricsName, StreamName
-from localstack.services.stores import AccountRegionBundle, BaseStore, LocalAttribute
+from localstack.aws.api.kinesis import (
+    ConsumerDescription,
+    MetricsName,
+    Policy,
+    ResourceARN,
+    StreamName,
+)
+from localstack.services.stores import (
+    AccountRegionBundle,
+    BaseStore,
+    CrossAccountAttribute,
+    LocalAttribute,
+)
 
 
 class KinesisStore(BaseStore):
@@ -13,5 +24,7 @@ class KinesisStore(BaseStore):
         default=lambda: defaultdict(set)
     )
 
+    resource_policies: dict[ResourceARN, Policy] = CrossAccountAttribute(default=dict)
+
 
 kinesis_stores = AccountRegionBundle("kinesis", KinesisStore)

localstack/services/kinesis/packages.py

@@ -7,7 +7,7 @@ from localstack.packages import InstallTarget, Package
 from localstack.packages.core import GitHubReleaseInstaller, NodePackageInstaller
 from localstack.packages.java import JavaInstallerMixin, java_package
 
-_KINESIS_MOCK_VERSION = os.environ.get("KINESIS_MOCK_VERSION") or "0.4.13"
+_KINESIS_MOCK_VERSION = os.environ.get("KINESIS_MOCK_VERSION") or "0.5.1"
 
 
 class KinesisMockEngine(StrEnum):

localstack/services/kinesis/provider.py

@@ -1,5 +1,7 @@
+import json
 import logging
 import os
+import re
 import time
 from random import random
 
@@ -8,14 +10,18 @@ from localstack.aws.api import RequestContext
 from localstack.aws.api.kinesis import (
     ConsumerARN,
     Data,
+    GetResourcePolicyOutput,
     HashKey,
     KinesisApi,
     PartitionKey,
+    Policy,
     ProvisionedThroughputExceededException,
     PutRecordOutput,
     PutRecordsOutput,
     PutRecordsRequestEntryList,
     PutRecordsResultEntry,
+    ResourceARN,
+    ResourceNotFoundException,
     SequenceNumber,
     ShardId,
     StartingPosition,
@@ -24,6 +30,7 @@ from localstack.aws.api.kinesis import (
     SubscribeToShardEvent,
     SubscribeToShardEventStream,
     SubscribeToShardOutput,
+    ValidationException,
 )
 from localstack.aws.connect import connect_to
 from localstack.constants import LOCALHOST
@@ -39,6 +46,13 @@ LOG = logging.getLogger(__name__)
 MAX_SUBSCRIPTION_SECONDS = 300
 SERVER_STARTUP_TIMEOUT = 120
 
+DATA_STREAM_ARN_REGEX = re.compile(
+    r"^arn:aws(?:-[a-z]+)*:kinesis:[a-z0-9-]+:\d{12}:stream\/[a-zA-Z0-9_.\-]+$"
+)
+CONSUMER_ARN_REGEX = re.compile(
+    r"^arn:aws(?:-[a-z]+)*:kinesis:[a-z0-9-]+:\d{12}:stream\/[a-zA-Z0-9_.\-]+\/consumer\/[a-zA-Z0-9_.\-]+:\d+$"
+)
+
 
 def find_stream_for_consumer(consumer_arn):
     account_id = extract_account_id_from_arn(consumer_arn)
@@ -52,6 +66,11 @@ def find_stream_for_consumer(consumer_arn):
     raise Exception(f"Unable to find stream for stream consumer {consumer_arn}")
 
 
+def is_valid_kinesis_arn(resource_arn: ResourceARN) -> bool:
+    """Check if the provided ARN is a valid Kinesis ARN."""
+    return bool(CONSUMER_ARN_REGEX.match(resource_arn) or DATA_STREAM_ARN_REGEX.match(resource_arn))
+
+
 class KinesisProvider(KinesisApi, ServiceLifecycleHook):
     server_manager: KinesisServerManager
 
@@ -81,6 +100,64 @@ class KinesisProvider(KinesisApi, ServiceLifecycleHook):
     def get_store(account_id: str, region_name: str) -> KinesisStore:
         return kinesis_stores[account_id][region_name]
 
+    def put_resource_policy(
+        self,
+        context: RequestContext,
+        resource_arn: ResourceARN,
+        policy: Policy,
+        **kwargs,
+    ) -> None:
+        if not is_valid_kinesis_arn(resource_arn):
+            raise ValidationException(f"invalid kinesis arn {resource_arn}")
+
+        kinesis = connect_to(
+            aws_access_key_id=context.account_id, region_name=context.region
+        ).kinesis
+        try:
+            kinesis.describe_stream_summary(StreamARN=resource_arn)
+        except kinesis.exceptions.ResourceNotFoundException:
+            raise ResourceNotFoundException(f"Stream with ARN {resource_arn} not found")
+
+        store = self.get_store(context.account_id, context.region)
+        store.resource_policies[resource_arn] = policy
+
+    def get_resource_policy(
+        self,
+        context: RequestContext,
+        resource_arn: ResourceARN,
+        **kwargs,
+    ) -> GetResourcePolicyOutput:
+        if not is_valid_kinesis_arn(resource_arn):
+            raise ValidationException(f"invalid kinesis arn {resource_arn}")
+
+        kinesis = connect_to(
+            aws_access_key_id=context.account_id, region_name=context.region
+        ).kinesis
+        try:
+            kinesis.describe_stream_summary(StreamARN=resource_arn)
+        except kinesis.exceptions.ResourceNotFoundException:
+            raise ResourceNotFoundException(f"Stream with ARN {resource_arn} not found")
+
+        store = self.get_store(context.account_id, context.region)
+        policy = store.resource_policies.get(resource_arn, json.dumps({}))
+        return GetResourcePolicyOutput(Policy=policy)
+
+    def delete_resource_policy(
+        self,
+        context: RequestContext,
+        resource_arn: ResourceARN,
+        **kwargs,
+    ) -> None:
+        if not is_valid_kinesis_arn(resource_arn):
+            raise ValidationException(f"invalid kinesis arn {resource_arn}")
+
+        store = self.get_store(context.account_id, context.region)
+        if resource_arn not in store.resource_policies:
+            raise ResourceNotFoundException(
+                f"No resource policy found for resource ARN {resource_arn}"
+            )
+        del store.resource_policies[resource_arn]
+
     def subscribe_to_shard(
         self,
         context: RequestContext,

localstack/services/kms/models.py

@@ -173,6 +173,7 @@ class KmsCryptoKey:
     public_key: bytes | None
     private_key: bytes | None
     key_material: bytes
+    pending_key_material: bytes | None
     key_spec: str
 
     @staticmethod
@@ -217,6 +218,7 @@ class KmsCryptoKey:
     def __init__(self, key_spec: str, key_material: bytes | None = None):
         self.private_key = None
         self.public_key = None
+        self.pending_key_material = None
         # Technically, key_material, being a symmetric encryption key, is only relevant for
         #   key_spec == SYMMETRIC_DEFAULT.
         # But LocalStack uses symmetric encryption with this key_material even for other specs. Asymmetric keys are
@@ -248,8 +250,9 @@ class KmsCryptoKey:
         self._serialize_key(key)
 
     def load_key_material(self, material: bytes):
-        if self.key_spec in [
-            KeySpec.SYMMETRIC_DEFAULT,
+        if self.key_spec == KeySpec.SYMMETRIC_DEFAULT:
+            self.pending_key_material = material
+        elif self.key_spec in [
             KeySpec.HMAC_224,
             KeySpec.HMAC_256,
             KeySpec.HMAC_384,
@@ -323,9 +326,28 @@ class KmsKey:
             # remove the _custom_key_material_ tag from the tags to not readily expose the custom key material
             del self.tags[TAG_KEY_CUSTOM_KEY_MATERIAL]
         self.crypto_key = KmsCryptoKey(self.metadata.get("KeySpec"), custom_key_material)
+        self._internal_key_id = uuid.uuid4()
+
+        # The KMS implementation always provides a crypto key with key material which doesn't suit scenarios where a
+        # KMS Key may have no key material e.g. for external keys. Don't expose the CurrentKeyMaterialId in those cases.
+        if custom_key_material or (
+            self.metadata["Origin"] == "AWS_KMS"
+            and self.metadata["KeySpec"] == KeySpec.SYMMETRIC_DEFAULT
+        ):
+            self.metadata["CurrentKeyMaterialId"] = self.generate_key_material_id(
+                self.crypto_key.key_material
+            )
+
         self.rotation_period_in_days = 365
         self.next_rotation_date = None
 
+    def generate_key_material_id(self, key_material: bytes) -> str:
+        # The KeyMaterialId depends on the key material and the KeyId. Use an internal ID to prevent brute forcing
+        # the value of the key material from the public KeyId and KeyMaterialId.
+        # https://docs.aws.amazon.com/kms/latest/APIReference/API_ImportKeyMaterial.html
+        key_material_id_hex = uuid.uuid5(self._internal_key_id, key_material).hex
+        return str(key_material_id_hex) * 2
+
     def calculate_and_set_arn(self, account_id, region):
         self.metadata["Arn"] = kms_key_arn(self.metadata.get("KeyId"), account_id, region)
 
@@ -746,8 +768,16 @@ class KmsKey:
                 f"The on-demand rotations limit has been reached for the given keyId. "
                 f"No more on-demand rotations can be performed for this key: {self.metadata['Arn']}"
             )
-        self.previous_keys.append(self.crypto_key.key_material)
-        self.crypto_key = KmsCryptoKey(KeySpec.SYMMETRIC_DEFAULT)
+        current_key_material = self.crypto_key.key_material
+        pending_key_material = self.crypto_key.pending_key_material
+
+        self.previous_keys.append(current_key_material)
+
+        # If there is no pending material stored on the key, then key material will be generated.
+        self.crypto_key = KmsCryptoKey(KeySpec.SYMMETRIC_DEFAULT, pending_key_material)
+        self.metadata["CurrentKeyMaterialId"] = self.generate_key_material_id(
+            self.crypto_key.key_material
+        )
 
 
 class KmsGrant:

localstack/services/kms/provider.py

@@ -4,10 +4,13 @@ import datetime
 import logging
 import os
 
+from cbor2 import loads as cbor2_loads
 from cryptography.exceptions import InvalidTag
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import hashes, keywrap
 from cryptography.hazmat.primitives.asymmetric import padding
+from cryptography.hazmat.primitives.asymmetric.rsa import RSAPublicKey
+from cryptography.hazmat.primitives.serialization import load_der_public_key
 
 from localstack.aws.api import CommonServiceException, RequestContext, handler
 from localstack.aws.api.kms import (
@@ -85,6 +88,7 @@ from localstack.aws.api.kms import (
     MacAlgorithmSpec,
     MarkerType,
     MultiRegionKey,
+    MultiRegionKeyType,
     NotFoundException,
     NullableBooleanType,
     OriginType,
@@ -137,6 +141,7 @@ from localstack.services.plugins import ServiceLifecycleHook
 from localstack.utils.aws.arns import get_partition, kms_alias_arn, parse_arn
 from localstack.utils.collections import PaginatedList
 from localstack.utils.common import select_attributes
+from localstack.utils.crypto import pkcs7_envelope_encrypt
 from localstack.utils.strings import short_uid, to_bytes, to_str
 
 LOG = logging.getLogger(__name__)
@@ -490,26 +495,39 @@ class KmsProvider(KmsApi, ServiceLifecycleHook):
         self, context: RequestContext, request: ReplicateKeyRequest
     ) -> ReplicateKeyResponse:
         account_id = context.account_id
-        key = self._get_kms_key(account_id, context.region, request.get("KeyId"))
-        key_id = key.metadata.get("KeyId")
-        if not key.metadata.get("MultiRegion"):
+        primary_key = self._get_kms_key(account_id, context.region, request.get("KeyId"))
+        key_id = primary_key.metadata.get("KeyId")
+        key_arn = primary_key.metadata.get("Arn")
+        if not primary_key.metadata.get("MultiRegion"):
             raise UnsupportedOperationException(
                 f"Unable to replicate a non-MultiRegion key {key_id}"
             )
         replica_region = request.get("ReplicaRegion")
         replicate_to_store = kms_stores[account_id][replica_region]
+
+        if (
+            primary_key.metadata.get("MultiRegionConfiguration", {}).get("MultiRegionKeyType")
+            != MultiRegionKeyType.PRIMARY
+        ):
+            raise UnsupportedOperationException(f"{key_arn} is not a multi-region primary key.")
+
         if key_id in replicate_to_store.keys:
             raise AlreadyExistsException(
                 f"Unable to replicate key {key_id} to region {replica_region}, as the key "
                 f"already exist there"
             )
-        replica_key = copy.deepcopy(key)
+        replica_key = copy.deepcopy(primary_key)
         replica_key.replicate_metadata(request, account_id, replica_region)
         replicate_to_store.keys[key_id] = replica_key
 
-        self.update_primary_key_with_replica_keys(key, replica_key, replica_region)
+        self.update_primary_key_with_replica_keys(primary_key, replica_key, replica_region)
 
-        return ReplicateKeyResponse(ReplicaKeyMetadata=replica_key.metadata)
+        # CurrentKeyMaterialId is not returned in the ReplicaKeyMetadata. May be due to not being evaluated until
+        # the key has been successfully replicated as it does not show up in DescribeKey immediately either.
+        replica_key_metadata_response = copy.deepcopy(replica_key.metadata)
+        replica_key_metadata_response.pop("CurrentKeyMaterialId", None)
+
+        return ReplicateKeyResponse(ReplicaKeyMetadata=replica_key_metadata_response)
 
     @staticmethod
     # Adds new multi region replica key to the primary key's metadata.
@@ -1066,6 +1084,25 @@ class KmsProvider(KmsApi, ServiceLifecycleHook):
         self._validate_key_for_encryption_decryption(context, key)
         self._validate_key_state_not_pending_import(key)
 
+        # Handle the recipient field.  This is used by AWS Nitro to re-encrypt the plaintext to the key specified
+        # by the enclave.  Proper support for this will take significant work to figure out how to model enforcing
+        # the attestation measurements; for now, if recipient is specified and has an attestation doc in it including
+        # a public key where it's expected to be, we encrypt to that public key.  This at least allows users to use
+        # localstack as a drop-in replacement for AWS when testing without having to skip the secondary decryption
+        # when using localstack.
+        recipient_pubkey = None
+        if recipient:
+            attestation_document = recipient["AttestationDocument"]
+            # We do all of this in a try/catch and warn if it fails so that if users are currently passing a nonsense
+            # value we don't break it for them.  In the future we could do a breaking change to require a valid attestation
+            # (or at least one that contains the public key).
+            try:
+                recipient_pubkey = self._extract_attestation_pubkey(attestation_document)
+            except Exception as e:
+                logging.warning(
+                    "Unable to extract public key from non-empty attestation document: %s", e
+                )
+
         try:
             # TODO: Extend the implementation to handle additional encryption/decryption scenarios
             # beyond the current support for offline encryption and online decryption using RSA keys if key id exists in
@@ -1079,20 +1116,27 @@ class KmsProvider(KmsApi, ServiceLifecycleHook):
                 plaintext = key.decrypt(ciphertext, encryption_context)
         except InvalidTag:
             raise InvalidCiphertextException()
+
         # For compatibility, we return EncryptionAlgorithm values expected from AWS. But LocalStack currently always
         # encrypts with symmetric encryption no matter the key settings.
         #
         # We return a key ARN instead of KeyId despite the name of the parameter, as this is what AWS does and states
         # in its docs.
-        # TODO add support for "recipient"
         #  https://docs.aws.amazon.com/kms/latest/APIReference/API_Decrypt.html#API_Decrypt_RequestSyntax
         # TODO add support for "dry_run"
-        return DecryptResponse(
+        response = DecryptResponse(
             KeyId=key.metadata.get("Arn"),
-            Plaintext=plaintext,
             EncryptionAlgorithm=encryption_algorithm,
         )
 
+        # Encrypt to the recipient pubkey if specified.  Otherwise, return the actual plaintext
+        if recipient_pubkey:
+            response["CiphertextForRecipient"] = pkcs7_envelope_encrypt(plaintext, recipient_pubkey)
+        else:
+            response["Plaintext"] = plaintext
+
+        return response
+
     def get_parameters_for_import(
         self,
         context: RequestContext,
@@ -1167,13 +1211,10 @@ class KmsProvider(KmsApi, ServiceLifecycleHook):
         # TODO check if there was already a key imported for this kms key
         # if so, it has to be identical. We cannot change keys by reimporting after deletion/expiry
         key_material = self._decrypt_wrapped_key_material(import_state, encrypted_key_material)
-
-        if expiration_model:
-            key_to_import_material_to.metadata["ExpirationModel"] = expiration_model
-        else:
-            key_to_import_material_to.metadata["ExpirationModel"] = (
-                ExpirationModelType.KEY_MATERIAL_EXPIRES
-            )
+        key_material_id = key_to_import_material_to.generate_key_material_id(key_material)
+        key_to_import_material_to.metadata["ExpirationModel"] = (
+            expiration_model or ExpirationModelType.KEY_MATERIAL_EXPIRES
+        )
         if (
             key_to_import_material_to.metadata["ExpirationModel"]
             == ExpirationModelType.KEY_MATERIAL_EXPIRES
@@ -1182,12 +1223,42 @@ class KmsProvider(KmsApi, ServiceLifecycleHook):
             raise ValidationException(
                 "A validTo date must be set if the ExpirationModel is KEY_MATERIAL_EXPIRES"
             )
+        if existing_pending_material := key_to_import_material_to.crypto_key.pending_key_material:
+            pending_key_material_id = key_to_import_material_to.generate_key_material_id(
+                existing_pending_material
+            )
+            raise KMSInvalidStateException(
+                f"New key material (id: {key_material_id}) cannot be imported into KMS key "
+                f"{key_to_import_material_to.metadata['Arn']}, because another key material "
+                f"(id: {pending_key_material_id}) is pending rotation."
+            )
+
         # TODO actually set validTo and make the key expire
         key_to_import_material_to.metadata["Enabled"] = True
         key_to_import_material_to.metadata["KeyState"] = KeyState.Enabled
         key_to_import_material_to.crypto_key.load_key_material(key_material)
 
-        return ImportKeyMaterialResponse()
+        # KeyMaterialId / CurrentKeyMaterialId is only exposed for symmetric encryption keys.
+        key_material_id_response = None
+        if key_to_import_material_to.metadata["KeySpec"] == KeySpec.SYMMETRIC_DEFAULT:
+            key_material_id_response = key_to_import_material_to.generate_key_material_id(
+                key_material
+            )
+
+            # If there is no CurrentKeyMaterialId, instantly promote the pending key material to the current.
+            if key_to_import_material_to.metadata.get("CurrentKeyMaterialId") is None:
+                key_to_import_material_to.metadata["CurrentKeyMaterialId"] = (
+                    key_material_id_response
+                )
+                key_to_import_material_to.crypto_key.key_material = (
+                    key_to_import_material_to.crypto_key.pending_key_material
+                )
+                key_to_import_material_to.crypto_key.pending_key_material = None
+
+        return ImportKeyMaterialResponse(
+            KeyId=key_to_import_material_to.metadata["Arn"],
+            KeyMaterialId=key_material_id_response,
+        )
 
     def delete_imported_key_material(
         self,
@@ -1314,7 +1385,7 @@ class KmsProvider(KmsApi, ServiceLifecycleHook):
         key = self._get_kms_key(account_id, region_name, key_id, any_key_state_allowed=True)
 
         response = GetKeyRotationStatusResponse(
-            KeyId=key_id,
+            KeyId=key.metadata["Arn"],
             KeyRotationEnabled=key.is_key_rotation_enabled,
             NextRotationDate=key.next_rotation_date,
         )
@@ -1406,13 +1477,13 @@ class KmsProvider(KmsApi, ServiceLifecycleHook):
 
         if key.metadata["KeySpec"] != KeySpec.SYMMETRIC_DEFAULT:
             raise UnsupportedOperationException()
-        if key.metadata["Origin"] == OriginType.EXTERNAL:
-            raise NotImplementedError("Rotation of imported keys is not supported yet.")
+        self._validate_key_state_not_pending_import(key)
+        self._validate_external_key_has_pending_material(key)
 
         key.rotate_key_on_demand()
 
         return RotateKeyOnDemandResponse(
-            KeyId=key_id,
+            KeyId=key.metadata["Arn"],
         )
 
     @handler("TagResource", expand=False)
@@ -1489,6 +1560,12 @@ class KmsProvider(KmsApi, ServiceLifecycleHook):
         if key.metadata["KeyState"] == KeyState.PendingImport:
             raise KMSInvalidStateException(f"{key.metadata['Arn']} is pending import.")
 
+    def _validate_external_key_has_pending_material(self, key: KmsKey):
+        if key.metadata["Origin"] == "EXTERNAL" and key.crypto_key.pending_key_material is None:
+            raise KMSInvalidStateException(
+                f"No available key material pending rotation for the key: {key.metadata['Arn']}."
+            )
+
     def _validate_key_for_encryption_decryption(self, context: RequestContext, key: KmsKey):
         key_usage = key.metadata["KeyUsage"]
         if key_usage != "ENCRYPT_DECRYPT":
@@ -1550,6 +1627,15 @@ class KmsProvider(KmsApi, ServiceLifecycleHook):
                     f" constraint: [Member must satisfy enum value set: {VALID_OPERATIONS}]"
                 )
 
+    def _extract_attestation_pubkey(self, attestation_document: bytes) -> RSAPublicKey:
+        # The attestation document comes as a COSE (CBOR Object Signing and Encryption) object: the CBOR
+        # attestation is signed and then the attestation and signature are again CBOR-encoded.  For now
+        # we don't bother validating the signature, though in the future we could.
+        cose_document = cbor2_loads(attestation_document)
+        attestation = cbor2_loads(cose_document[2])
+        public_key_bytes = attestation["public_key"]
+        return load_der_public_key(public_key_bytes)
+
     def _decrypt_wrapped_key_material(
         self,
         import_state: KeyImportState,

localstack/services/lambda_/api_utils.py

@@ -722,7 +722,9 @@ def validate_layer_runtimes_and_architectures(
         validations.append(validation_msg)
 
     if compatible_architectures and set(compatible_architectures).difference(ARCHITECTURES):
-        constraint = "[Member must satisfy enum value set: [x86_64, arm64]]"
+        constraint = (
+            "[Member must satisfy enum value set: [x86_64, arm64], Member must not be null]"
+        )
         validation_msg = f"Value '[{', '.join(list(compatible_architectures))}]' at 'compatibleArchitectures' failed to satisfy constraint: Member must satisfy constraint: {constraint}"
         validations.append(validation_msg)
 

localstack/services/lambda_/invocation/internal_sqs_queue.py

@@ -19,13 +19,9 @@ from localstack.aws.api.sqs import (
     String,
     TagMap,
 )
-from localstack.services.sqs.models import SqsQueue, StandardQueue
-from localstack.services.sqs.provider import (
-    QueueUpdateWorker,
-    _create_message_attribute_hash,
-    to_sqs_api_message,
-)
-from localstack.services.sqs.utils import generate_message_id
+from localstack.services.sqs.models import SqsQueue, StandardQueue, to_sqs_api_message
+from localstack.services.sqs.provider import QueueUpdateWorker
+from localstack.services.sqs.utils import create_message_attribute_hash, generate_message_id
 from localstack.utils.objects import singleton_factory
 from localstack.utils.strings import md5
 from localstack.utils.time import now
@@ -189,7 +185,7 @@ class FakeSqsClient:
             MD5OfBody=md5(MessageBody),
             Body=MessageBody,
             Attributes=self._create_message_attributes(MessageSystemAttributes),
-            MD5OfMessageAttributes=_create_message_attribute_hash(MessageAttributes),
+            MD5OfMessageAttributes=create_message_attribute_hash(MessageAttributes),
             MessageAttributes=MessageAttributes,
         )
         queue_item = queue.put(
@@ -204,7 +200,7 @@ class FakeSqsClient:
             "MD5OfMessageBody": message["MD5OfBody"],
             "MD5OfMessageAttributes": message.get("MD5OfMessageAttributes"),
             "SequenceNumber": queue_item.sequence_number,
-            "MD5OfMessageSystemAttributes": _create_message_attribute_hash(MessageSystemAttributes),
+            "MD5OfMessageSystemAttributes": create_message_attribute_hash(MessageSystemAttributes),
         }
 
 

localstack/services/lambda_/packages.py

@@ -12,7 +12,7 @@ from localstack.utils.platform import get_arch
 """Customized LocalStack version of the AWS Lambda Runtime Interface Emulator (RIE).
 https://github.com/localstack/lambda-runtime-init/blob/localstack/README-LOCALSTACK.md
 """
-LAMBDA_RUNTIME_DEFAULT_VERSION = "v0.1.35-pre"
+LAMBDA_RUNTIME_DEFAULT_VERSION = "v0.1.37-pre"
 LAMBDA_RUNTIME_VERSION = config.LAMBDA_INIT_RELEASE_VERSION or LAMBDA_RUNTIME_DEFAULT_VERSION
 LAMBDA_RUNTIME_INIT_URL = "https://github.com/localstack/lambda-runtime-init/releases/download/{version}/aws-lambda-rie-{arch}"