fix proxy deregistration and enable all CloudWatch tests

- Add DELETE endpoint to remove proxies from PROXY_INSTANCES
- Add deregister_from_instance() method in auth_proxy.py
- Update test fixture to deregister proxies during cleanup
- Remove xfail markers from CloudWatch tests that now pass
- Add _reconstruct_request_body for Query protocol services
- Add resource name matching for CloudWatch and CloudWatch Logs

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: whummer

aws-proxy/aws_proxy/client/auth_proxy.py

@@ -1,3 +1,4 @@
+# Note/disclosure: This file has been partially modified by an AI agent.
 import json
 import logging
 import os
@@ -180,6 +181,19 @@ def register_in_instance(self):
             )
             raise
 
+    def deregister_from_instance(self):
+        """Deregister this proxy from the LocalStack instance."""
+        port = getattr(self, "port", None)
+        if not port:
+            return
+        url = f"{external_service_url()}{HANDLER_PATH_PROXIES}/{port}"
+        LOG.debug("Deregistering proxy from main container via: %s", url)
+        try:
+            response = requests.delete(url)
+            return response
+        except Exception as e:
+            LOG.debug("Unable to deregister auth proxy: %s", e)
+
     def _parse_aws_request(
         self, request: Request, service_name: str, region_name: str, client
     ) -> Tuple[OperationModel, AWSPreparedRequest, Dict]:

aws-proxy/aws_proxy/server/aws_request_forwarder.py

@@ -1,9 +1,12 @@
+# Note/disclosure: This file has been partially modified by an AI agent.
 import json
 import logging
 import re
 from typing import Dict, Optional
+from urllib.parse import urlencode
 
 import requests
+from botocore.serialize import create_serializer
 from localstack.aws.api import RequestContext
 from localstack.aws.chain import Handler, HandlerChain
 from localstack.constants import APPLICATION_JSON, LOCALHOST, LOCALHOST_HOSTNAME
@@ -193,6 +196,12 @@ def forward_request(
                 data = request.form
             elif request.data:
                 data = request.data
+
+            # Fallback: if data is empty and we have parsed service_request,
+            # reconstruct the request body (handles cases where form data was consumed)
+            if not data and context.service_request:
+                data = self._reconstruct_request_body(context, ctype)
+
             LOG.debug(
                 "Forward request: %s %s - %s - %s",
                 request.method,
@@ -292,3 +301,29 @@ def _get_canonical_service_name(cls, service_name: str) -> str:
             "monitoring": "cloudwatch",
         }
         return mapping.get(service_name, service_name)
+
+    def _reconstruct_request_body(
+        self, context: RequestContext, content_type: str
+    ) -> bytes:
+        """
+        Reconstruct the request body from the parsed service_request.
+        This is used when the original request body was consumed during parsing.
+        """
+        try:
+            protocol = context.service.protocol
+            if protocol == "query" or "x-www-form-urlencoded" in (content_type or ""):
+                # For Query protocol, serialize using botocore serializer
+                serializer = create_serializer(protocol)
+                operation_model = context.operation
+                serialized = serializer.serialize_to_request(
+                    context.service_request, operation_model
+                )
+                body = serialized.get("body", {})
+                if isinstance(body, dict):
+                    return urlencode(body, doseq=True)
+                return body
+            elif protocol == "json" or protocol == "rest-json":
+                return json.dumps(context.service_request)
+        except Exception as e:
+            LOG.debug("Failed to reconstruct request body: %s", e)
+        return b""

aws-proxy/aws_proxy/server/request_handler.py

@@ -1,3 +1,4 @@
+# Note/disclosure: This file has been partially modified by an AI agent.
 import json
 import logging
 import os.path
@@ -43,6 +44,11 @@ def add_proxy(self, request: Request, **kwargs):
         result = handle_proxies_request(req)
         return result or {}
 
+    @route(f"{HANDLER_PATH_PROXIES}/<int:port>", methods=["DELETE"])
+    def delete_proxy(self, request: Request, port: int, **kwargs):
+        removed = AwsProxyHandler.PROXY_INSTANCES.pop(port, None)
+        return {"removed": removed is not None}
+
     @route(f"{HANDLER_PATH_PROXIES}/status", methods=["GET"])
     def get_status(self, request: Request, **kwargs):
         containers = get_proxy_containers()

aws-proxy/tests/conftest.py

@@ -1,3 +1,4 @@
+# Note/disclosure: This file has been partially modified by an AI agent.
 import os
 
 import pytest
@@ -51,4 +52,6 @@ def _start(config: dict = None):
     yield _start
 
     for proxy in proxies:
+        # Deregister from LocalStack instance before shutting down
+        proxy.deregister_from_instance()
         proxy.shutdown()

aws-proxy/tests/proxy/test_cloudwatch.py

@@ -3,7 +3,6 @@
 from datetime import datetime, timezone
 
 import boto3
-import pytest
 from localstack.aws.connect import connect_to
 from localstack.utils.strings import short_uid
 from localstack.utils.sync import retry
@@ -144,9 +143,6 @@ def test_cloudwatch_alarm_operations(start_aws_proxy, cleanups):
     assert alarms_aws_2["MetricAlarms"][0]["AlarmName"] == alarm_name_2
 
 
-@pytest.mark.xfail(
-    reason="CloudWatch Query protocol: form data stream consumed before proxy receives request"
-)
 def test_cloudwatch_readonly_operations(start_aws_proxy, cleanups):
     """Test CloudWatch operations in read-only proxy mode."""
     alarm_name = f"test-readonly-alarm-{short_uid()}"
@@ -206,9 +202,6 @@ def test_cloudwatch_readonly_operations(start_aws_proxy, cleanups):
     assert len(alarms_aws_new["MetricAlarms"]) == 0
 
 
-@pytest.mark.xfail(
-    reason="CloudWatch Query protocol: form data consumed before resource matching check"
-)
 def test_cloudwatch_resource_name_matching(start_aws_proxy, cleanups):
     """Test that proxy forwards requests for specific CloudWatch alarms matching ARN pattern."""
     alarm_name_match = f"proxy-alarm-{short_uid()}"