ministackorg/ministack v1.3.36

on GitHub

What's Changed

New Contributors

• @staranto made their first contribution in #615
• @spicykay made their first contribution in #609

[1.3.36] — 2026-05-11

Added

• IAM AWS-managed policies (arn:aws:iam::aws:policy/<Name>) — real AWS hosts these under a virtual aws account every customer can read; MiniStack used to key every policy by the caller's account so GetPolicy(arn:aws:iam::aws:policy/AdministratorAccess) returned NoSuchEntity. AWS-managed policies now live in a separate non-account-scoped store, pre-seeded with 20 of the most commonly referenced policies (AdministratorAccess, PowerUserAccess, ReadOnlyAccess, SecurityAudit, AWSLambdaBasicExecutionRole, AmazonS3FullAccess/ReadOnlyAccess, AmazonEC2FullAccess/ReadOnlyAccess, AmazonSSMManagedInstanceCore, AmazonDynamoDBFullAccess, AWSLambdaVPCAccessExecutionRole, and friends) carrying their canonical AWS documents verbatim. Unknown AWS-managed ARNs return NoSuchEntity by default so typos surface locally; opt in to permissive autovivify with MINISTACK_AUTOCREATE_AWS_MANAGED=1. AttachmentCount is tracked per-(session-account, arn) via an account-scoped sidecar, matching real AWS where the counter is per-account. ListPolicies respects Scope=All/AWS/Local; attach/detach work against any AWS-managed ARN; mutation operations (CreatePolicy into the aws namespace, DeletePolicy, TagPolicy, UntagPolicy, CreatePolicyVersion, DeletePolicyVersion) return AccessDenied / InvalidInput to match real AWS. Contributed by @spicykay.
• Cost and Usage Reports (CUR) — full 7-operation surface (PutReportDefinition, DescribeReportDefinitions, ModifyReportDefinition, DeleteReportDefinition, TagResource, UntagResource, ListTagsForResource). Report definitions persist; report file generation is not emulated (MiniStack doesn't track usage or compute costs), so this targets IaC validation — Terraform / CDK / Bash automation that manages aws_cur_report_definition resources can now plan and apply against MiniStack without hitting real AWS billing. Contributed by @staranto.
• Lambda Ruby 4.0 runtime — ruby4.0 maps to public.ecr.aws/lambda/ruby:4.0, tracking the runtime AWS added in May 2026 (botocore 1.42.94).

Fixed

• RDS DescribeDBClusters serialization — DatabaseName, NetworkType, EngineLifecycleSupport — three independent shape bugs on the same code path. DatabaseName was stored as "" and always emitted, so botocore parsed it as the empty string instead of null; the field is now stored as None when unset and only emitted when truthy, matching real-AWS XML elision. NetworkType and EngineLifecycleSupport were never stored or serialized; they're now accepted from the request and emit with the AWS-documented defaults (IPV4 and open-source-rds-extended-support). Surfaced by brownfield-import diffing against a real-AWS captured Aurora cluster. Contributed by @jayjanssen.
• RDS DescribeDBClusterParameters emits <Source> element — the cluster-parameter response XML omitted <Source> entirely, so botocore materialized Parameters[].Source as None for every entry. Each emitted <Parameter> now includes <Source>user</Source>, matching the existing instance-level path. Note: MiniStack only stores user-modified parameters (engine defaults are not modelled); the literal user is correct for the slice MS currently returns but will need to become conditional once engine-defaults are added. Surfaced by the same brownfield-import diffing. Contributed by @jayjanssen.
• CUR report definitions lost on warm-boot — the CUR module declared get_state() and restore_state() but the load_state("cur") call at import time was missing, so MiniStack wrote state on shutdown and never read it on restart. Standard import-time block added; PERSIST_STATE=1 now correctly survives across container restarts for CUR.
• IAM AttachmentCount on AWS-managed policies reset on warm-boot — the per-(session-account, arn) sidecar _aws_managed_attachment_counts added with the AWS-managed-policies work was missing from get_state / restore_state. Customer-managed AttachmentCount already persisted via the policy record itself; only the AWS-managed-policy sidecar was dropped. Now wired in.