DOC-311 Update IAM docs for descriptive enforcement denial messages

README.md

@@ -1,5 +1,6 @@
 # LocalStack Docs v2
 
+
 This is just the Starlight starter for now. We can begin moving existing content into `/content/docs`.
 
 ## Starlight Starter Kit: Basics

astro.config.mjs

@@ -629,10 +629,6 @@ export default defineConfig({
                   label: 'LocalStack Docker Extension',
                   slug: 'aws/configuration/localstack-docker-extension',
                 },
-                {
-                  label: 'LocalSurf',
-                  slug: 'aws/configuration/localsurf',
-                },
               ],
             },
             {

public/_redirects

@@ -122,7 +122,7 @@
 /references/coverage/coverage_es/ /aws/services/es 301
 /user-guide/integrations/sdks/javascript/ /aws/connecting/aws-sdks/net/javascript 301
 /references/coverage/coverage_iam/ /aws/services/iam 301
-/user-guide/tools/localsurf/ /aws/configuration/localsurf 301
+/user-guide/tools/localsurf/ /aws/customization/networking/ 301
 /user-guide/extensions/extensions-library/ /aws/configuration/extensions/extensions-library 301
 /tutorials/ecs-ecr-container-app/ /aws/tutorials/ecs-ecr-container-app 301
 /references/coverage/coverage_elastictranscoder/ /aws/services/elastictranscoder 301
@@ -529,7 +529,7 @@
 /references/coverage/coverage_es /aws/services/es 301
 /user-guide/integrations/sdks/javascript /aws/connecting/aws-sdks/net/javascript 301
 /references/coverage/coverage_iam /aws/services/iam 301
-/user-guide/tools/localsurf /aws/configuration/localsurf 301
+/user-guide/tools/localsurf /aws/customization/networking/ 301
 /user-guide/extensions/extensions-library /aws/configuration/extensions/extensions-library 301
 /tutorials/ecs-ecr-container-app /aws/tutorials/ecs-ecr-container-app 301
 /references/coverage/coverage_elastictranscoder /aws/services/elastictranscoder 301
@@ -944,8 +944,8 @@
 /aws/tooling/testing-utils/ /aws/configuration/testing-utils 301
 /aws/tooling/localstack-docker-extension /aws/configuration/localstack-docker-extension 301
 /aws/tooling/localstack-docker-extension/ /aws/configuration/localstack-docker-extension 301
-/aws/tooling/localsurf /aws/configuration/localsurf 301
-/aws/tooling/localsurf/ /aws/configuration/localsurf 301
+/aws/tooling/localsurf /aws/customization/networking/ 301
+/aws/tooling/localsurf/ /aws/customization/networking/ 301
 /aws/tooling /aws/developer-tools 301
 /aws/tooling/ /aws/developer-tools/ 301
 
@@ -999,8 +999,8 @@
 /aws/capabilities/localstack-sdks/java-sdk/ /aws/configuration/localstack-sdks/java-sdk 301
 /aws/capabilities/localstack-sdks/python-sdk /aws/configuration/localstack-sdks/python-sdk 301
 /aws/capabilities/localstack-sdks/python-sdk/ /aws/configuration/localstack-sdks/python-sdk 301
-/aws/capabilities/localsurf /aws/configuration/localsurf 301
-/aws/capabilities/localsurf/ /aws/configuration/localsurf 301
+/aws/capabilities/localsurf /aws/customization/networking/ 301
+/aws/capabilities/localsurf/ /aws/customization/networking/ 301
 /aws/capabilities/networking /aws/configuration/networking 301
 /aws/capabilities/networking/ /aws/configuration/networking 301
 /aws/capabilities/networking/accessing-endpoint-url /aws/configuration/networking/accessing-endpoint-url 301

scripts/redirects/_redirects

@@ -121,7 +121,7 @@
 /references/coverage/coverage_es/ /aws/services/es 301
 /user-guide/integrations/sdks/javascript/ /aws/integrations/aws-sdks/net/javascript 301
 /references/coverage/coverage_iam/ /aws/services/iam 301
-/user-guide/tools/localsurf/ /aws/tooling/localsurf 301
+/user-guide/tools/localsurf/ /aws/customization/networking/ 301
 /user-guide/extensions/extensions-library/ /aws/tooling/extensions/extensions-library 301
 /tutorials/ecs-ecr-container-app/ /aws/tutorials/ecs-ecr-container-app 301
 /references/coverage/coverage_elastictranscoder/ /aws/services/elastictranscoder 301

scripts/redirects/redirects_config.json

@@ -612,7 +612,7 @@
     },
     {
       "old_link": "/user-guide/tools/localsurf/",
-      "new_link": "/aws/tooling/localsurf",
+      "new_link": "/aws/customization/networking",
       "status_code": 301
     },
     {

src/content/docs/aws/configuration/config/configuration.md

@@ -197,14 +197,20 @@ This section covers configuration options that are specific to certain AWS servi
 
 | Variable | Example Values | Description |
 | - | - | - |
-| `EKS_K3S_FLAGS` | | Customize the `k3s` cluster created by LocalStack to emulate EKS clusters. |
+| `K3S_FLAGS` | | Customize the `k3s` cluster created by LocalStack to emulate EKS clusters. (formerly `EKS_K3S_FLAGS`, still accepted as a deprecated alias) |
 | `EKS_LOADBALANCER_PORT` | `8081` (default) | Local port on which the Kubernetes load balancer is exposed on the host. |
-| `EKS_K3S_IMAGE_TAG` | `v1.31.5-k3s1` (default) | Custom tag of the `rancher/k3s` image used to spin up Kubernetes clusters locally. |
-| `EKS_K8S_PROVIDER` | `k3s` (default)\|`local` | The k8s provider which should be used to start the k8s cluster backing EKS. For more information on the providers, please see [Elastic Kubernetes Service (EKS)](/aws/services/eks) |
-| `EKS_K3S_IMAGE_REPOSITORY` | `rancher/k3s` (default) | Custom repository of the `rancher/k3s` image used to spin up Kubernetes clusters locally. |
-| `EKS_START_K3D_LB_INGRESS` |      `0` (default)     |  Whether to start the k3d load balancer and Traefik ingress controller automatically when creating an EKS cluster. Set to `1` to enable.  |
+| `K3S_IMAGE_TAG` | `v1.31.5-k3s1` (default) | Custom tag of the `rancher/k3s` image used to spin up Kubernetes clusters locally. (formerly `EKS_K3S_IMAGE_TAG`, still accepted as a deprecated alias) |
+| `MANAGED_K8S_PROVIDER` | `k3s` (default)\|`local` | The k8s provider which should be used to start the k8s cluster backing EKS. For more information on the providers, please see [Elastic Kubernetes Service (EKS)](/aws/services/eks) (formerly `EKS_K8S_PROVIDER`, still accepted as a deprecated alias) |
+| `K3S_IMAGE_REPOSITORY` | `rancher/k3s` (default) | Custom repository of the `rancher/k3s` image used to spin up Kubernetes clusters locally. (formerly `EKS_K3S_IMAGE_REPOSITORY`, still accepted as a deprecated alias) |
+| `K3D_START_LB_INGRESS` |      `0` (default)     |  Whether to start the k3d load balancer and Traefik ingress controller automatically when creating an EKS cluster. Set to `1` to enable. (formerly `EKS_START_K3D_LB_INGRESS`, still accepted as a deprecated alias)  |
 | `EKS_PERSIST_CLUSTER_CONTENTS` | `0` (default) | When Persistence is enabled or when saving/loading Cloud Pods, this flag can be used to control whether the content deployed to EKS clusters will be persisted. Set to `1` to enable. |
-| `EKS_K3D_CLUSTER_TOKEN` | `localstack-k3d-cluster-token` (default) | Token used to authenticate agent nodes joining a k3d-backed EKS cluster. Setting an explicit token ensures consistent node authentication across k3d versions, which is required for dynamic agent assignment. Can be overridden via the `EKS_K3D_CLUSTER_TOKEN` environment variable. |
+| `K3D_CLUSTER_TOKEN` | `localstack-k3d-cluster-token` (default) | Token used to authenticate agent nodes joining a k3d-backed EKS cluster. Setting an explicit token ensures consistent node authentication across k3d versions, which is required for dynamic agent assignment. (formerly `EKS_K3D_CLUSTER_TOKEN`, still accepted as a deprecated alias) |
+
+:::note
+The EKS configuration variables were renamed to cloud-agnostic names since they're shared across cloud emulators (AWS EKS / Azure AKS). The previous `EKS_*`, `LOCALSTACK_K8S_*`, and `LAMBDA_K8S_*` names still work as deprecated aliases and will be removed in a future release.
+
+If you configure these options through the LocalStack CLI **v1**, keep the `LOCALSTACK_` prefix on the new names (e.g. `LOCALSTACK_MANAGED_K8S_PROVIDER`). The CLI v1 only forwards host environment variables prefixed with `LOCALSTACK_` into the container, where the prefix is stripped to yield the in-container variable (`MANAGED_K8S_PROVIDER`).
+:::
 
 ### ElastiCache
 
@@ -462,7 +468,6 @@ To learn more about these configuration options, see [DNS Server](/aws/configura
 
 | Variable             | Example Values | Description |
 |----------------------|----------------|-------------|
-| `ACTIVATE_PRO`       | `0` \| `1` (default)    | Whether Pro should be activated or not. This is set to true by default if using the `localstack/localstack-pro` container image. If set to `1`, LocalStack will fail to start if the license key activation did not work. If set to `0`, an attempt is made to start LocalStack without Pro features. |
 | `LOCALSTACK_AUTH_TOKEN` |             | [Auth token](/aws/getting-started/auth-token) to activate LocalStack for AWS. |
 | `LOCALSTACK_API_KEY` |                | **Deprecated since 3.0.0** API key to activate LocalStack for AWS.<br/> **Use the `LOCALSTACK_AUTH_TOKEN` instead (except for [CI environments](/aws/integrations/continuous-integration/)).** |
 | `LOG_LICENSE_ISSUES` | `0` \| `1`&nbsp;(default)    | Whether to log issues with the license activation to the console. |

src/content/docs/aws/configuration/index.mdx

@@ -13,7 +13,7 @@ LocalStack provides a number of configuration options and supporting tools that
 
 It brings together the configuration options that control LocalStack's behavior, networking setup for reaching your services, the LocalStack Web App, the LocalStack SDKs for programmatic access, and the extensions mechanism for adding new functionality.
 
-You will also find guides for several standalone tools: the [DNS Server](/aws/configuration/dns-server), [Testing Utils](/aws/configuration/testing-utils), the [LocalStack Docker Extension](/aws/configuration/localstack-docker-extension), and [LocalSurf](/aws/configuration/localsurf).
+You will also find guides for several standalone tools: the [DNS Server](/aws/configuration/dns-server), [Testing Utils](/aws/configuration/testing-utils), and the [LocalStack Docker Extension](/aws/configuration/localstack-docker-extension).
 
 <SectionCards
   basePath="aws/configuration/"

src/content/docs/aws/developer-tools/app-inspector/index.md

@@ -64,6 +64,8 @@ The interface enables you to trace the flow of operations, identify relationship
 
 ![App Inspector event list showing a fanout pipeline across EventBridge, Lambda, SQS, and SNS](/images/aws/app-inspector/app-inspector-fanout-pipeline.png)
 
+Use the search box above the operations list to filter by any text fragment, such as a resource name, an ARN segment, a status message, or a payload snippet. Search is case-insensitive, matches substrings anywhere in the field, and covers the full result set rather than just the operations currently loaded on screen.
+
 ### Graph View and Operation Details
 
 Click **View Detail** to visualize the relationships between AWS services in your application as an interactive graph. Each node represents a service, and each edge represents a call between them, making it easy to follow the path of a request across your architecture.