localstack-core 4.7.1.dev139__py3-none-any.whl → 4.10.1.dev7__py3-none-any.whl

localstack/constants.py

@@ -80,6 +80,10 @@ ENV_INTERNAL_TEST_RUN = "LOCALSTACK_INTERNAL_TEST_RUN"
 # environment variable name to tag collect metrics during a test run
 ENV_INTERNAL_TEST_COLLECT_METRIC = "LOCALSTACK_INTERNAL_TEST_COLLECT_METRIC"
 
+# environment variable name to indicate that metrics should be stored within the container
+ENV_INTERNAL_TEST_STORE_METRICS_IN_LOCALSTACK = "LOCALSTACK_INTERNAL_TEST_METRICS_IN_LOCALSTACK"
+ENV_INTERNAL_TEST_STORE_METRICS_PATH = "LOCALSTACK_INTERNAL_TEST_STORE_METRICS_PATH"
+
 # environment variable that flags whether pro was activated. do not use it for security purposes!
 ENV_PRO_ACTIVATED = "PRO_ACTIVATED"
 
@@ -102,32 +106,6 @@ FALSE_STRINGS = ("0", "false", "False")
 # strings with valid log levels for LS_LOG
 LOG_LEVELS = ("trace-internal", "trace", "debug", "info", "warn", "error", "warning")
 
-# the version of elasticsearch that is pre-seeded into the base image (sync with Dockerfile.base)
-ELASTICSEARCH_DEFAULT_VERSION = "Elasticsearch_7.10"
-# See https://docs.aws.amazon.com/ja_jp/elasticsearch-service/latest/developerguide/aes-supported-plugins.html
-ELASTICSEARCH_PLUGIN_LIST = [
-    "analysis-icu",
-    "ingest-attachment",
-    "analysis-kuromoji",
-    "mapper-murmur3",
-    "mapper-size",
-    "analysis-phonetic",
-    "analysis-smartcn",
-    "analysis-stempel",
-    "analysis-ukrainian",
-]
-# Default ES modules to exclude (save apprx 66MB in the final image)
-ELASTICSEARCH_DELETE_MODULES = ["ingest-geoip"]
-
-# the version of opensearch which is used by default
-OPENSEARCH_DEFAULT_VERSION = "OpenSearch_2.11"
-
-# See https://docs.aws.amazon.com/opensearch-service/latest/developerguide/supported-plugins.html
-OPENSEARCH_PLUGIN_LIST = [
-    "ingest-attachment",
-    "analysis-kuromoji",
-]
-
 # API endpoint for analytics events
 API_ENDPOINT = os.environ.get("API_ENDPOINT") or "https://api.localstack.cloud/v1"
 # new analytics API endpoint
@@ -171,9 +149,6 @@ DEFAULT_DEVELOP_PORT = 5678
 DEFAULT_BUCKET_MARKER_LOCAL = "hot-reload"
 LEGACY_DEFAULT_BUCKET_MARKER_LOCAL = "__local__"
 
-# user that starts the opensearch process if the current user is root
-OS_USER_OPENSEARCH = "localstack"
-
 # output string that indicates that the stack is ready
 READY_MARKER_OUTPUT = "Ready."
 

localstack/dev/kubernetes/__main__.py

@@ -32,7 +32,7 @@ def generate_mount_points(
 
     # container paths
     target_path = "/opt/code/localstack/"
-    venv_path = os.path.join(target_path, ".venv", "lib", "python3.11", "site-packages")
+    venv_path = os.path.join(target_path, ".venv", "lib", "python3.13", "site-packages")
 
     # Community code
     if pro:

localstack/dev/run/paths.py

@@ -68,7 +68,7 @@ class ContainerPaths:
     """Important paths in the container"""
 
     project_dir: str = "/opt/code/localstack"
-    site_packages_target_dir: str = "/opt/code/localstack/.venv/lib/python3.11/site-packages"
+    site_packages_target_dir: str = "/opt/code/localstack/.venv/lib/python3.13/site-packages"
     docker_entrypoint: str = "/usr/local/bin/docker-entrypoint.sh"
     localstack_supervisor: str = "/usr/local/bin/localstack-supervisor"
     localstack_source_dir: str

localstack/dns/plugins.py

@@ -11,8 +11,12 @@ DNS_SHUTDOWN_PRIORITY = -30
 """Make sure the DNS server is shut down after the ON_AFTER_SERVICE_SHUTDOWN_HANDLERS, which in turn is after
 SERVICE_SHUTDOWN_PRIORITY. Currently this value needs to be less than -20"""
 
+DNS_START_PRIORITY = 20
+"""Make sure the DNS server is started before the pro activation, to ensure proper DNS resolution for the activate call,
+if the resolv.conf is set to localhost from outside the container"""
 
-@hooks.on_infra_start(priority=10)
+
+@hooks.on_infra_start(priority=DNS_START_PRIORITY)
 def start_dns_server():
     try:
         from localstack.dns import server

localstack/dns/server.py

@@ -445,13 +445,22 @@ class Resolver(DnsServerProtocol):
                 return True
         return False
 
+    def _find_matching_aliases(self, question: DNSQuestion) -> list[AliasTarget] | None:
+        """
+        Find aliases matching the question, supporting wildcards.
+        """
+        qlabel = DNSLabel(to_bytes(question.qname))
+        qtype = RecordType[QTYPE[question.qtype]]
+        for (label, rtype), targets in self.aliases.items():
+            if rtype == qtype and qlabel.matchWildcard(label):
+                return targets
+        return None
+
     def _resolve_alias(
         self, request: DNSRecord, reply: DNSRecord, client_address: ClientAddress
     ) -> bool:
         if request.q.qtype in (QTYPE.A, QTYPE.AAAA, QTYPE.CNAME):
-            key = (DNSLabel(to_bytes(request.q.qname)), RecordType[QTYPE[request.q.qtype]])
-            # check if we have aliases defined for our given qname/qtype pair
-            if aliases := self.aliases.get(key):
+            if aliases := self._find_matching_aliases(request.q):
                 for alias in aliases:
                     # if there is no health check, or the healthcheck is successful, we will consider this alias
                     # take the first alias passing this check

localstack/packages/api.py

@@ -3,10 +3,11 @@ import functools
 import logging
 import os
 from collections import defaultdict
+from collections.abc import Callable
 from enum import Enum
 from inspect import getmodule
-from threading import RLock
-from typing import Any, Callable, Generic, Optional, ParamSpec, TypeVar
+from threading import Lock, RLock
+from typing import Any, Generic, ParamSpec, TypeVar
 
 from plux import Plugin, PluginManager, PluginSpec  # type: ignore
 
@@ -56,7 +57,7 @@ class PackageInstaller(abc.ABC):
     multiple versions).
     """
 
-    def __init__(self, name: str, version: str, install_lock: Optional[RLock] = None):
+    def __init__(self, name: str, version: str, install_lock: Lock | None = None):
         """
         :param name: technical package name, f.e. "opensearch"
         :param version: version of the package to install
@@ -70,7 +71,7 @@ class PackageInstaller(abc.ABC):
         self.install_lock = install_lock or RLock()
         self._setup_for_target: dict[InstallTarget, bool] = defaultdict(lambda: False)
 
-    def install(self, target: Optional[InstallTarget] = None) -> None:
+    def install(self, target: InstallTarget | None = None) -> None:
         """
         Performs the package installation.
 
@@ -210,7 +211,7 @@ class Package(abc.ABC, Generic[T]):
         """
         return self.get_installer(version).get_installed_dir()
 
-    def install(self, version: str | None = None, target: Optional[InstallTarget] = None) -> None:
+    def install(self, version: str | None = None, target: InstallTarget | None = None) -> None:
         """
         Installs the package in the given version in the preferred target location.
         :param version: version of the package to install. If None, the default version of the package will be used.
@@ -274,7 +275,7 @@ class MultiPackageInstaller(PackageInstaller):
         assert len(package_installer) > 0
         self.package_installer = package_installer
 
-    def install(self, target: Optional[InstallTarget] = None) -> None:
+    def install(self, target: InstallTarget | None = None) -> None:
         """
         Installs the different packages this installer is composed of.
 
@@ -356,7 +357,7 @@ class PackagesPluginManager(PluginManager[PackagesPlugin]):  # type: ignore[misc
         )
 
     def get_packages(
-        self, package_names: list[str], version: Optional[str] = None
+        self, package_names: list[str], version: str | None = None
     ) -> list[Package[PackageInstaller]]:
         # Plugin names are unique, but there could be multiple packages with the same name in different scopes
         plugin_specs_per_name = defaultdict(list)
@@ -390,7 +391,7 @@ T2 = TypeVar("T2")
 def package(
     name: str | None = None,
     scope: str = "community",
-    should_load: Optional[Callable[[], bool]] = None,
+    should_load: Callable[[], bool] | None = None,
 ) -> Callable[[Callable[[], Package[Any] | list[Package[Any]]]], PluginSpec]:
     """
     Decorator for marking methods that create Package instances as a PackagePlugin.

localstack/packages/core.py

@@ -4,7 +4,7 @@ import re
 from abc import ABC
 from functools import lru_cache
 from sys import version_info
-from typing import Any, Optional
+from typing import Any
 
 import requests
 
@@ -238,7 +238,7 @@ class NodePackageInstaller(ExecutableInstaller):
         self,
         package_name: str,
         version: str,
-        package_spec: Optional[str] = None,
+        package_spec: str | None = None,
         main_module: str = "main.js",
     ):
         """

localstack/packages/plugins.py

@@ -5,14 +5,6 @@ from localstack.packages.api import Package, package
 if TYPE_CHECKING:
     from localstack.packages.ffmpeg import FfmpegPackageInstaller
     from localstack.packages.java import JavaPackageInstaller
-    from localstack.packages.terraform import TerraformPackageInstaller
-
-
-@package(name="terraform")
-def terraform_package() -> Package["TerraformPackageInstaller"]:
-    from .terraform import terraform_package
-
-    return terraform_package
 
 
 @package(name="ffmpeg")

localstack/runtime/init.py

@@ -89,7 +89,7 @@ class ShellScriptRunner(ScriptRunner):
     suffixes = [".sh"]
 
     def run(self, path: str) -> None:
-        exit_code = subprocess.call(args=[], executable=path)
+        exit_code = subprocess.call(args=[path])
         if exit_code != 0:
             raise OSError(f"Script {path} returned a non-zero exit code {exit_code}")
 

localstack/services/apigateway/legacy/provider.py

@@ -323,8 +323,18 @@ class ApigatewayProvider(ApigatewayApi, ServiceLifecycleHook):
         tags: MapOfStringToString = None,
         **kwargs,
     ) -> ApiKey:
+        if name and len(name) > 1024:
+            raise BadRequestException("Invalid API Key name, can be at most 1024 characters.")
+        if value:
+            if len(value) > 128:
+                raise BadRequestException("API Key value exceeds maximum size of 128 characters")
+            elif len(value) < 20:
+                raise BadRequestException("API Key value should be at least 20 characters")
+        if description and len(description) > 125000:
+            raise BadRequestException("Invalid API Key description specified.")
         api_key = call_moto(context)
-
+        if name == "":
+            api_key.pop("name", None)
         #  transform array of stage keys [{'restApiId': '0iscapk09u', 'stageName': 'dev'}] into
         #  array of strings ['0iscapk09u/dev']
         stage_keys = api_key.get("stageKeys", [])
@@ -2054,6 +2064,20 @@ class ApigatewayProvider(ApigatewayApi, ServiceLifecycleHook):
             for integration_response in integration_responses.values():
                 remove_empty_attributes_from_integration_response(integration_response)
 
+        if response.get("connectionType") == "VPC_LINK":
+            # FIXME: this is hacky to workaround moto not saving the VPC Link `connectionId`
+            # only do this internal check of Moto if the integration is of VPC_LINK type
+            moto_rest_api = get_moto_rest_api(context=context, rest_api_id=rest_api_id)
+            try:
+                method = moto_rest_api.resources[resource_id].resource_methods[http_method]
+                integration = method.method_integration
+                if connection_id := getattr(integration, "connection_id", None):
+                    response["connectionId"] = connection_id
+
+            except (AttributeError, KeyError):
+                # this error should have been caught by `call_moto`
+                pass
+
         return response
 
     def put_integration(
@@ -2108,6 +2132,7 @@ class ApigatewayProvider(ApigatewayApi, ServiceLifecycleHook):
         moto_request.setdefault("timeoutInMillis", 29000)
         if integration_type in (IntegrationType.HTTP, IntegrationType.HTTP_PROXY):
             moto_request.setdefault("connectionType", ConnectionType.INTERNET)
+
         response = call_moto_with_request(context, moto_request)
         remove_empty_attributes_from_integration(integration=response)
 
@@ -2115,6 +2140,13 @@ class ApigatewayProvider(ApigatewayApi, ServiceLifecycleHook):
         if integration_type == "MOCK":
             response.pop("uri", None)
 
+        # TODO: moto does not save the connection_id
+        elif moto_request.get("connectionType") == "VPC_LINK":
+            connection_id = moto_request.get("connectionId", "")
+            # attach the connection id to the moto object
+            method.method_integration.connection_id = connection_id
+            response["connectionId"] = connection_id
+
         return response
 
     def update_integration(
@@ -2136,6 +2168,7 @@ class ApigatewayProvider(ApigatewayApi, ServiceLifecycleHook):
             raise NotFoundException("Invalid Integration identifier specified")
 
         integration = method.method_integration
+        # TODO: validate the patch operations
         patch_api_gateway_entity(integration, patch_operations)
 
         # fix data types
@@ -2144,8 +2177,12 @@ class ApigatewayProvider(ApigatewayApi, ServiceLifecycleHook):
         if skip_verification := (integration.tls_config or {}).get("insecureSkipVerification"):
             integration.tls_config["insecureSkipVerification"] = str_to_bool(skip_verification)
 
-        integration_dict: Integration = integration.to_json()
-        return integration_dict
+        response: Integration = integration.to_json()
+
+        if connection_id := getattr(integration, "connection_id", None):
+            response["connectionId"] = connection_id
+
+        return response
 
     def delete_integration(
         self,
@@ -2393,6 +2430,10 @@ class ApigatewayProvider(ApigatewayApi, ServiceLifecycleHook):
             for api_key in api_keys:
                 api_key.pop("value")
 
+        if limit is not None:
+            if limit < 1 or limit > 500:
+                limit = None
+
         item_list = PaginatedList(api_keys)
 
         def token_generator(item):
@@ -2417,6 +2458,14 @@ class ApigatewayProvider(ApigatewayApi, ServiceLifecycleHook):
         patch_operations: ListOfPatchOperation = None,
         **kwargs,
     ) -> ApiKey:
+        for patch_op in patch_operations:
+            if patch_op["path"] not in ("/description", "/enabled", "/name", "/customerId"):
+                raise BadRequestException(
+                    f"Invalid patch path  '{patch_op['path']}' specified for op '{patch_op['op']}'. Must be one of: [/description, /enabled, /name, /customerId]"
+                )
+
+            if patch_op["path"] == "/description" and len(patch_op["value"]) > 125000:
+                raise BadRequestException("Invalid API Key description specified.")
         response: ApiKey = call_moto(context)
         if "value" in response:
             response.pop("value", None)
@@ -2977,6 +3026,7 @@ def create_custom_context(
     ctx = create_aws_request_context(
         service_name=context.service.service_name,
         action=action,
+        protocol=context.service.protocol,
         parameters=parameters,
         region=context.region,
     )

localstack/services/apigateway/next_gen/execute_api/integrations/aws.py

@@ -211,6 +211,9 @@ class RestApiAwsIntegration(RestApiIntegration):
             action = parsed_uri["path"]
 
             if target := self.get_action_service_target(service_name, action):
+                # TODO: properly implement the auto-`Content-Type` headers depending on the service protocol
+                #  e.g. `x-amz-json-1.0` for DynamoDB
+                #  this is needed to properly support multi-protocol
                 headers["X-Amz-Target"] = target
 
             query_params["Action"] = action

localstack/services/apigateway/next_gen/execute_api/integrations/http.py

@@ -8,7 +8,7 @@ from werkzeug.datastructures import Headers
 from localstack.aws.api.apigateway import Integration
 
 from ..context import EndpointResponse, IntegrationRequest, RestApiInvocationContext
-from ..gateway_response import ApiConfigurationError, IntegrationFailureError
+from ..gateway_response import ApiConfigurationError, IntegrationFailureError, InternalServerError
 from ..header_utils import build_multi_value_headers
 from .core import RestApiIntegration
 
@@ -72,7 +72,7 @@ class RestApiHttpIntegration(BaseRestApiHttpIntegration):
         except (requests.exceptions.InvalidURL, requests.exceptions.InvalidSchema) as e:
             LOG.warning("Execution failed due to configuration error: Invalid endpoint address")
             LOG.debug("The URI specified for the HTTP/HTTP_PROXY integration is invalid: %s", uri)
-            raise ApiConfigurationError("Internal server error") from e
+            raise InternalServerError("Internal server error") from e
 
         except (requests.exceptions.Timeout, requests.exceptions.SSLError) as e:
             # TODO make the exception catching more fine grained
@@ -127,7 +127,7 @@ class RestApiHttpProxyIntegration(BaseRestApiHttpIntegration):
         except (requests.exceptions.InvalidURL, requests.exceptions.InvalidSchema) as e:
             LOG.warning("Execution failed due to configuration error: Invalid endpoint address")
             LOG.debug("The URI specified for the HTTP/HTTP_PROXY integration is invalid: %s", uri)
-            raise ApiConfigurationError("Internal server error") from e
+            raise InternalServerError("Internal server error") from e
 
         except (requests.exceptions.Timeout, requests.exceptions.SSLError):
             # TODO make the exception catching more fine grained

localstack/services/apigateway/next_gen/execute_api/test_invoke.py

@@ -62,6 +62,17 @@ TEST_INVOKE_TEMPLATE_MOCK = """Execution log for request {request_id}
 {formatted_date} : Method completed with status: {method_response_status}
 """
 
+TEST_INVOKE_TEMPLATE_FAILED = """Execution log for request {request_id}
+{formatted_date} : Starting execution for request: {request_id}
+{formatted_date} : HTTP Method: {request_method}, Resource Path: {resource_path}
+{formatted_date} : Method request path: {method_request_path_parameters}
+{formatted_date} : Method request query string: {method_request_query_string}
+{formatted_date} : Method request headers: {method_request_headers}
+{formatted_date} : Method request body before transformations: {method_request_body}
+{formatted_date} : Execution failed due to {error_type}: {error_message}
+{formatted_date} : Method completed with status: {method_response_status}
+"""
+
 
 def _dump_headers(headers: Headers) -> str:
     if not headers:
@@ -80,9 +91,9 @@ def log_template(invocation_context: RestApiInvocationContext, response_headers:
     formatted_date = datetime.datetime.now(tz=datetime.UTC).strftime("%a %b %d %H:%M:%S %Z %Y")
     request = invocation_context.invocation_request
     context_var = invocation_context.context_variables
-    integration_req = invocation_context.integration_request
-    endpoint_resp = invocation_context.endpoint_response
-    method_resp = invocation_context.invocation_response
+    integration_req = invocation_context.integration_request or {}
+    endpoint_resp = invocation_context.endpoint_response or {}
+    method_resp = invocation_context.invocation_response or {}
     # TODO: if endpoint_uri is an ARN, it means it's an AWS_PROXY integration
     #  this should be transformed to the true URL of a lambda invoke call
     endpoint_uri = integration_req.get("uri", "")
@@ -116,7 +127,7 @@ def log_mock_template(
     formatted_date = datetime.datetime.now(tz=datetime.UTC).strftime("%a %b %d %H:%M:%S %Z %Y")
     request = invocation_context.invocation_request
     context_var = invocation_context.context_variables
-    method_resp = invocation_context.invocation_response
+    method_resp = invocation_context.invocation_response or {}
 
     return TEST_INVOKE_TEMPLATE_MOCK.format(
         formatted_date=formatted_date,
@@ -133,6 +144,29 @@ def log_mock_template(
     )
 
 
+def log_failed_template(
+    invocation_context: RestApiInvocationContext, response_status_code: int
+) -> str:
+    formatted_date = datetime.datetime.now(tz=datetime.UTC).strftime("%a %b %d %H:%M:%S %Z %Y")
+    request = invocation_context.invocation_request
+    context_var = invocation_context.context_variables
+
+    return TEST_INVOKE_TEMPLATE_FAILED.format(
+        formatted_date=formatted_date,
+        request_id=context_var["requestId"],
+        resource_path=request["path"],
+        request_method=request["http_method"],
+        method_request_path_parameters=dict_to_string(request["path_parameters"]),
+        method_request_query_string=dict_to_string(request["query_string_parameters"]),
+        method_request_headers=_dump_headers(request.get("headers")),
+        method_request_body=to_str(request.get("body", "")),
+        method_response_status=response_status_code,
+        # TODO: fix the error message
+        error_type="",
+        error_message="",
+    )
+
+
 def create_test_chain() -> HandlerChain[RestApiInvocationContext]:
     return HandlerChain(
         request_handlers=[
@@ -216,7 +250,9 @@ def create_test_invocation_context(
         responseOverride=ContextVarsResponseOverride(header={}, status=0),
     )
     invocation_context.trace_id = parse_handler.populate_trace_id({})
-    resource_method = resource["resourceMethods"][http_method]
+    resource_method = (
+        resource["resourceMethods"].get(http_method) or resource["resourceMethods"]["ANY"]
+    )
     invocation_context.resource = resource
     invocation_context.resource_method = resource_method
     invocation_context.integration = resource_method["methodIntegration"]
@@ -256,7 +292,15 @@ def run_test_invocation(
     # AWS does not return the Content-Length for TestInvokeMethod
     response_headers.remove("Content-Length")
 
-    if is_mock_integration:
+    if not invocation_context.invocation_response:
+        # TODO: this is an heuristic to guess if we encounter an exception in the call
+        #  in the future, we should attach the exception to the context so we could act on it and properly
+        #  log as we go through the invocation, so that if we have an error we stop logging at the right moment
+        for header in ("Content-Type", "X-Amzn-Trace-Id"):
+            response_headers.remove(header)
+        log = log_failed_template(invocation_context, test_response.status_code)
+
+    elif is_mock_integration:
         # TODO: revisit how we're building the logs
         log = log_mock_template(invocation_context, response_headers)
     else:

localstack/services/apigateway/next_gen/provider.py

@@ -429,6 +429,11 @@ class ApigatewayNextGenProvider(ApigatewayProvider):
         if not resource:
             raise NotFoundException("Invalid Resource identifier specified")
 
+        resource_methods = resource.resource_methods
+
+        if request["httpMethod"] not in resource_methods and "ANY" not in resource_methods:
+            raise NotFoundException("Invalid Method identifier specified")
+
         # test httpMethod
 
         rest_api_container = get_rest_api_container(context, rest_api_id=rest_api_id)

localstack/services/cloudformation/engine/entities.py

@@ -14,7 +14,13 @@ from localstack.services.cloudformation.engine.v2.change_set_model import (
 )
 from localstack.utils.aws import arns
 from localstack.utils.collections import select_attributes
-from localstack.utils.id_generator import ExistingIds, ResourceIdentifier, Tags, generate_short_uid
+from localstack.utils.id_generator import (
+    ExistingIds,
+    ResourceIdentifier,
+    Tags,
+    generate_short_uid,
+    generate_uid,
+)
 from localstack.utils.json import clone_safe
 from localstack.utils.objects import recurse_object
 from localstack.utils.strings import long_uid, short_uid
@@ -75,6 +81,11 @@ class StackIdentifier(ResourceIdentifier):
         return generate_short_uid(resource_identifier=self, existing_ids=existing_ids, tags=tags)
 
 
+class StackIdentifierV2(StackIdentifier):
+    def generate(self, existing_ids: ExistingIds = None, tags: Tags = None) -> str:
+        return generate_uid(resource_identifier=self, existing_ids=existing_ids, tags=tags)
+
+
 # TODO: remove metadata (flatten into individual fields)
 class Stack:
     change_sets: list["StackChangeSet"]

localstack/services/cloudformation/engine/v2/change_set_model.py

@@ -681,9 +681,6 @@ class ChangeSetModel:
             scope=arguments_scope, before_value=before_arguments, after_value=after_arguments
         )
 
-        if intrinsic_function == "Ref" and arguments.value == "AWS::NoValue":
-            arguments.value = Nothing
-
         if is_created(before=before_arguments, after=after_arguments):
             change_type = ChangeType.CREATED
         elif is_removed(before=before_arguments, after=after_arguments):

localstack/services/cloudformation/engine/v2/change_set_model_describer.py

@@ -20,6 +20,7 @@ from localstack.services.cloudformation.engine.v2.change_set_model_preproc impor
     PreprocResource,
 )
 from localstack.services.cloudformation.v2.entities import ChangeSet
+from localstack.utils.numbers import is_number
 
 CHANGESET_KNOWN_AFTER_APPLY: Final[str] = "{{changeSet:KNOWN_AFTER_APPLY}}"
 
@@ -96,6 +97,19 @@ class ChangeSetModelDescriber(ChangeSetModelPreproc):
 
         return value
 
+    def visit_node_intrinsic_function(self, node_intrinsic_function: NodeIntrinsicFunction):
+        """
+        Intrinsic function results are always strings when referring to the describe output
+        """
+        # TODO: what about other places?
+        # TODO: should this be put in the preproc?
+        delta = super().visit_node_intrinsic_function(node_intrinsic_function)
+        if is_number(delta.before):
+            delta.before = str(delta.before)
+        if is_number(delta.after):
+            delta.after = str(delta.after)
+        return delta
+
     def visit_node_intrinsic_function_fn_join(
         self, node_intrinsic_function: NodeIntrinsicFunction
     ) -> PreprocEntityDelta:

localstack/services/cloudformation/engine/v2/change_set_model_executor.py

@@ -1,5 +1,6 @@
 import copy
 import logging
+import os
 import re
 import uuid
 from collections.abc import Callable
@@ -105,14 +106,15 @@ class ChangeSetModelExecutor(ChangeSetModelPreproc):
         except Exception as e:
             failure_message = str(e)
 
+        is_deletion = self._change_set.stack.status == StackStatus.DELETE_IN_PROGRESS
         if self._deferred_actions:
-            if failure_message:
-                # TODO: differentiate between update and create
-                self._change_set.stack.set_stack_status(StackStatus.ROLLBACK_IN_PROGRESS)
-            else:
+            if not is_deletion:
                 # TODO: correct status
+                # TODO: differentiate between update and create
                 self._change_set.stack.set_stack_status(
-                    StackStatus.UPDATE_COMPLETE_CLEANUP_IN_PROGRESS
+                    StackStatus.ROLLBACK_IN_PROGRESS
+                    if failure_message
+                    else StackStatus.UPDATE_COMPLETE_CLEANUP_IN_PROGRESS
                 )
 
             # perform all deferred actions such as deletions. These must happen in reverse from their
@@ -122,7 +124,7 @@ class ChangeSetModelExecutor(ChangeSetModelPreproc):
                 LOG.debug("executing deferred action: '%s'", deferred.name)
                 deferred.action()
 
-        if failure_message:
+        if failure_message and not is_deletion:
             # TODO: differentiate between update and create
             self._change_set.stack.set_stack_status(StackStatus.ROLLBACK_COMPLETE)
 
@@ -515,14 +517,11 @@ class ChangeSetModelExecutor(ChangeSetModelPreproc):
                 resource_type,
                 f'No resource provider found for "{resource_type}"',
             )
-            LOG.warning(
-                "Deployment of resource type %s successful due to config CFN_IGNORE_UNSUPPORTED_RESOURCE_TYPES",
-                resource_type,
-            )
-            LOG.warning(
-                "Deployment of resource type %s will fail in upcoming LocalStack releases unless CFN_IGNORE_UNSUPPORTED_RESOURCE_TYPES is explicitly enabled.",
-                resource_type,
-            )
+            if "CFN_IGNORE_UNSUPPORTED_RESOURCE_TYPES" not in os.environ:
+                LOG.warning(
+                    "Deployment of resource type %s succeeded, but will fail in upcoming LocalStack releases unless CFN_IGNORE_UNSUPPORTED_RESOURCE_TYPES is explicitly enabled.",
+                    resource_type,
+                )
             event = ProgressEvent(
                 OperationStatus.SUCCESS,
                 resource_model={},
@@ -577,7 +576,6 @@ class ChangeSetModelExecutor(ChangeSetModelPreproc):
                     )
                     # TODO: do we actually need this line?
                     resolved_resource.update(extra_resource_properties)
-
             case OperationStatus.FAILED:
                 reason = event.message
                 LOG.warning(