ministackorg/ministack v1.4.5

on GitHub

What's Changed

New Contributors

• @bfreitastgtg made their first contribution in #1145

[1.4.5] — 2026-07-22

Added

• API Gateway v1 — AWS::ApiGateway::Model CloudFormation support — stacks with request/response models failed with Unsupported resource type: AWS::ApiGateway::Model. Models now create, update, and delete against the v1 model store; JSON-valued schemas are normalized to the API's string representation and Ref returns the model name. Contributed by @robert-pitt-foodhub.
• API Gateway v1 — AWS::ApiGateway::DomainName CloudFormation support — CDK custom-domain stacks rolled back with Unsupported resource type. Regional and edge domains now provision through the v1 control plane; Ref returns the domain name and Fn::GetAtt exposes DistributionDomainName, DistributionHostedZoneId, DomainNameArn, RegionalDomainName, and RegionalHostedZoneId. Contributed by @robert-pitt-foodhub.
• API Gateway v1 — AWS::ApiGateway::BasePathMapping CloudFormation support — base path mappings now create, update, replace, and delete; an omitted BasePath maps to the root (none) mapping and Ref returns the mapping's identifier. Contributed by @robert-pitt-foodhub.
• API Gateway v1 — documentation parts — CreateDocumentationPart, GetDocumentationPart, GetDocumentationParts, UpdateDocumentationPart, and DeleteDocumentationPart, plus AWS::ApiGateway::DocumentationPart CloudFormation support. Ref returns the documentation part id and Fn::GetAtt DocumentationPartId is exposed. Contributed by @robert-pitt-foodhub.
• Lambda — AWS::Lambda::EventInvokeConfig CloudFormation support — CDK stacks configuring asynchronous retry limits, maximum event age, or on-success/on-failure destinations rolled back with Unsupported resource type. Configs are now isolated per function qualifier (version/alias), and GetFunctionEventInvokeConfig / ListFunctionEventInvokeConfigs return them per qualifier. Contributed by @robert-pitt-foodhub.
• CloudWatch — AWS::CloudWatch::Dashboard CloudFormation support — stacks containing dashboards rolled back with Unsupported resource type. Dashboards now create, update the body in place, replace on a name change, and delete; Ref returns the dashboard name. Contributed by @robert-pitt-foodhub.
• OpenSearch — AWS::OpenSearchService::Domain CloudFormation support — domains and CDK-generated access policies now provision through CloudFormation with in-place updates, replacement, rollback, and Fn::GetAtt for the domain ARN and endpoint. Contributed by @robert-pitt-foodhub.
• OpenSearch — package management — CreatePackage, UpdatePackage, DescribePackages, DeletePackage, AssociatePackage, DissociatePackage, and ListPackagesForDomain are now served. Packages report AVAILABLE and domain associations ACTIVE immediately, so a poll after create/update/associate succeeds on the first call. Reported by @Simon-Hayden-Dev.
• Cognito — AWS::Cognito::UserPoolGroup CloudFormation support — the raw group APIs existed but the CFN resource type failed the whole stack with Unsupported resource type. Groups now provision through CloudFormation, Ref returns the group name, and deletion removes the group from its member users. Contributed by @ryan-bennett.
• Cognito — resource servers (CreateResourceServer, UpdateResourceServer, DescribeResourceServer, DeleteResourceServer, ListResourceServers) plus AWS::Cognito::UserPoolResourceServer CloudFormation support. Every resource-server action previously returned InvalidAction: Unknown Cognito IDP action and the CFN resource type failed the whole stack. Resource servers are keyed by their caller-supplied Identifier within a pool, matching real AWS, and Ref on the CFN resource returns that Identifier. Contributed by @ryan-bennett.
• Cognito — GetTokensFromRefreshToken — the session-refresh action aws-amplify v6.15+ uses exclusively returned InvalidAction: Unknown Cognito IDP action, so Amplify apps silently lost their session when the access token expired. It now returns the same AuthenticationResult shape as REFRESH_TOKEN_AUTH; refresh token rotation and RefreshTokenReuseException are not modeled. Reported by @scriptgenerator64.
• Region scoping — Batch and SES — state is now isolated by account and region, so same-named resources in different regions no longer collide. Persisted state carries a versioned regional schema that an older binary refuses rather than misreads. Contributed by @Areson.

Fixed

• CloudFront — invalidations on CloudFormation-created distributions — CreateInvalidation on a distribution provisioned through CloudFormation raised a KeyError because the CFN path never initialized the invalidation store that the native CreateDistribution does. The store is now initialized on create and cleaned up on delete. Contributed by @robert-pitt-foodhub.
• CloudFormation/Lambda — CDK S3 bucket notification custom resources no longer hang — custom-resource properties reached CDK's bundled handler as Python bool/numbers instead of CloudFormation's string wire representation (it called .lower() on Managed), and the warm Python worker omitted log_stream_name, so the failure path couldn't PUT to the ResponseURL and the stack hung until the one-hour service timeout. Custom-resource properties now use the string representation and warm workers expose the standard Lambda context fields. Contributed by @robert-pitt-foodhub.
• API Gateway v1 — AWS::ApiGateway::Stage Ref — Ref returned <api-id>-<stage> instead of the stage name, so dependent resources failed GetStage with Invalid Stage identifier specified. Ref now returns the stage name, matching AWS. Contributed by @robert-pitt-foodhub.
• SQS — ListQueues pagination — results were silently truncated at MaxResults and no NextToken was returned or accepted, so a client with more than 1000 queues could not enumerate them all. ListQueues now returns a NextToken when more results remain and accepts it on the next page, across both the JSON and Query/XML protocols. Contributed by @bfreitastgtg.
• EC2 — DescribeSecurityGroupRules tags — the operation omitted each rule's Tags and SecurityGroupRuleArn, so Terraform's aws_vpc_security_group_ingress_rule saw perpetual tags_all drift. Rule tags set at authorize time (or via CreateTags on the sgr- id) are now stored and returned along with the rule ARN, and tag:/tag-key filters are honored. Reported by @staranto.
• Cognito — AWS::Cognito::UserPool LambdaConfig dropped by CloudFormation — the CFN provisioner built a pool's state without ever reading LambdaConfig from the template properties, so any Lambda trigger (PreTokenGeneration, PreSignUp, PostConfirmation, etc.) configured on a CFN-provisioned pool was silently never invoked, even though the identical raw CreateUserPool API call already honored it correctly. LambdaConfig is now copied onto the pool the same way the raw API does. Contributed by @ryan-bennett.