ministackorg/ministack v1.4.9

on GitHub

What's Changed

New Contributors

• @onelshina made their first contribution in #1219
• @bandle made their first contribution in #1227

[1.4.9] — 2026-08-01

Added

• Lambda MicroVMs — new service — control-plane emulation of the AWS Lambda MicroVM API (2025-09-09): RunMicrovm, GetMicrovm, ListMicrovms, SuspendMicrovm, ResumeMicrovm, TerminateMicrovm, CreateMicrovmImage, CreateMicrovmAuthToken, and CreateMicrovmShellAuthToken. MicroVMs transition straight to RUNNING and images to CREATED (no real provisioning); state is account- and region-scoped. Reported by @wparad.
• Region-scoped state — EC2, CloudTrail, ECR, Glue, OpenSearch, WAFv2, and Backup now isolate state by account and region, matching real AWS and joining IoT and AppSync Events from 1.4.8. Same-name resources in different regions no longer collide. WAFv2 homes CLOUDFRONT-scope resources in us-east-1 with global-segment ARNs. Persisted state carries the versioned regional schema (on-disk format v3) that an older binary refuses rather than misreads; legacy resources migrate by ARN region. Contributed by @Areson.
• Region-scoped state — ACM, Elastic Load Balancing (ALB/NLB), MediaConnect, and RDS Data now isolate state by account and region as well, using the same versioned regional schema (on-disk format v3) and by-ARN legacy migration.
• IAM — role update parity — CreateRole and GetRole now round-trip PermissionsBoundary; PutRolePermissionsBoundary / DeleteRolePermissionsBoundary update it with AWS-shaped role output and missing-role errors; and UpdateRoleDescription now returns and persists the updated role. This unblocks Terraform providers that reconcile fixed boundaries and descriptions on service roles. Contributed by @jayjanssen.

Changed

• S3 — presigned URL signatures are now verified — presigned SigV4 URLs were accepted without checking the signature, so a URL signed with bogus credentials, or one whose signed headers (content-type, content-length, …) were changed after signing, still succeeded. Presigned URLs are now verified against the server credential (AWS_SECRET_ACCESS_KEY, default test); a bad signature or a tampered signed header returns 403 SignatureDoesNotMatch, matching real S3. Header-signed and anonymous requests are unaffected. Reported by @BartekAndree.

Fixed

• Step Functions — aws-sdk:s3:headObject dropped the object's user Metadata map — the S3 REST-XML SDK-integration spec maps response headers to output fields by exact name, which cannot express the N dynamic x-amz-meta-* headers, so the task result carried no Metadata key and an ASL reading $.Metadata.<key> (e.g. States.StringToJson($.Metadata.shardcount) to size a downstream fan-out) failed with States.Runtime. The dispatcher now collects x-amz-meta-* response headers into a Metadata map with the prefix stripped, attached after the SFN key-convention pass so the metadata keys stay verbatim (lowercase, as S3 stores them) instead of being title-cased like API member names. Contributed by @michael-denyer.
• Cognito — CUSTOM_AUTH now honors Cognito-owned SRP challenges and passes ClientMetadata to DefineAuth — Amplify CUSTOM_WITH_SRP failed with USER_ID_FOR_SRP was not found because CUSTOM_AUTH always invoked CreateAuth and returned CUSTOM_CHALLENGE, even when DefineAuth returned PASSWORD_VERIFIER / SRP_A. InitiateAuth with SRP_A now records SRP_A success (AWS-like), returns built-in PASSWORD_VERIFIER challenge parameters, and continues the custom-auth session after RespondToAuthChallenge so MFA CUSTOM_CHALLENGE rounds still work. DefineAuth also receives ClientMetadata (previously hard-coded {}), matching Create/Verify. Contributed by @onelshina.
• EC2 - ModifySecurityGroupRules - this action was unimplemented and returned InvalidAction: Unknown EC2 action: ModifySecurityGroupRules. Full support is now provided. Contributed by @staranto.
• Step Functions — aws-sdk integrations for Query-protocol services sent malformed requests — the shared adapter numbered EC2 list parameters under the wrong wire names and passed the form body as a string rather than bytes, so calls such as aws-sdk:ec2:describeInstances and aws-sdk:sqs:getQueueAttributes failed or silently dropped parameters. EC2 list parameters are now numbered under their botocore wire names, the body is encoded to bytes, GetQueueAttributes returns the SDK Attributes map, and IsTruncated is emitted as a boolean. Contributed by @bandle.
• Step Functions — wildcard path projections now resolve — JSONPath wildcard ([*]) projections in ASL returned incorrect results. Contributed by @felixp-square.
• IoT — topic-rule Lambda action resolved the function in the wrong region — after IoT state became region-scoped, a topic rule invoking a Lambda action looked the function up in the request region rather than the function's own, so cross-region rule targets missed. Contributed by @Areson.
• S3 — GetBucketEncryption now returns the default SSE-S3 configuration — a bucket with no explicit encryption returned ServerSideEncryptionConfigurationNotFoundError, but since 5 January 2023 every S3 bucket has default SSE-S3 encryption, so real S3 returns an AES256 configuration. GetBucketEncryption now returns that default (matching AWS) rather than the error. Reported by @rsariyev-nav.
• SNS — subscription filter policies now match String.Array message attributes — a FilterPolicy compared the raw StringValue of a String.Array attribute (e.g. ["example.created"]) against the policy values, so array attributes never matched. Each element of a String.Array attribute is now evaluated separately, matching AWS. Reported by @cabrerafd.