ministackorg/ministack v1.5.10

on GitHub

What's Changed

New Contributors

• @Alexis-DevOps made their first contribution in #1677

[1.5.10] — 2026-09-10

Added

• Amazon Location — trackers and device positions — the service did not exist, so a client bound to it failed at the first call and a template with AWS::Location::Tracker did not deploy. CreateTracker, DescribeTracker, UpdateTracker, ListTrackers and DeleteTracker manage trackers, BatchUpdateDevicePosition, GetDevicePosition, BatchGetDevicePosition and GetDevicePositionHistory serve positions, and PositionFiltering applies (TimeBased stores one sample per 30 seconds per device, DistanceBased ignores a move under 30 m). Positions are held in memory, newest 100 per device, rather than for the service's 30 days. Contributed by @iot-rocket.
• AWS Signer — StartSigningJob with its S3 side effect — the signer API did not exist. StartSigningJob, DescribeSigningJob, ListSigningJobs, PutSigningProfile and GetSigningProfile are served natively; signing is synchronous and synthetic, so the marker object lands at prefix + jobId before the call returns and a caller whose contract is the signed object never polls. A missing source object, destination bucket or profile is ResourceNotFoundException with no job recorded. Contributed by @iot-rocket.
• IoT Wireless — GetPositionEstimate — the service was absent, so a client bound to it failed at the first call. POST /position-estimate now answers the way the API is shaped: the output structure declares a payload blob, so the body is the raw GeoJSON Point rather than a JSON envelope. The estimate resolves from Ip and is deterministic; WiFiAccessPoints, CellTowers and Gnss are accepted and not resolved. Contributed by @iot-rocket.
• Amazon Translate — batch text translation jobs — the service did not exist. StartTextTranslationJob, DescribeTextTranslationJob, ListTextTranslationJobs and StopTextTranslationJob run a job against the local S3 store, with the documented filters and paging. Contributed by @ppettitau.
• Lambda Core — network connectors — Terraform's aws_lambdacore_network_connector failed with Function not found: /2026-04-04/network-connectors: the service signs with Lambda's own credential scope, so the request reached the function router and the path was read as a function name. CreateNetworkConnector, GetNetworkConnector, UpdateNetworkConnector, DeleteNetworkConnector and ListNetworkConnectors now serve that path, with ClientToken idempotency and Marker/MaxItems paging. There is no VPC attachment behind a connector; it reaches ACTIVE on the next read. Reported by @edersonbrilhante.
• CloudFormation — the Rules section is evaluated — a template's rules were ignored; they now run after the parameters resolve and before any resource is touched, on CreateStack, UpdateStack and CreateChangeSet. A false Assert refuses the operation with its AssertDescription as a ValidationError, so the CDK's CheckBootstrapVersion rule refuses an outdated bootstrap instead of passing silently. Contributed by @iot-rocket.
• CloudFormation — the AWS::Include transform — an embedded Fn::Transform naming AWS::Include was carried into the stack as a literal key; it is now replaced by the contents of the S3 object its Location points to before the template is validated, and a location that is not an s3:// URI, a missing object or a nested include is refused before a stack exists. Contributed by @iot-rocket.

Changed

• API Gateway — a REST method's COGNITO_USER_POOLS authorizer is enforced — the v1 data plane matched only NONE, AWS_IAM and CUSTOM and passed everything else through, so a method fronted by a user-pool authorizer served every caller and requestContext.authorizer.claims was never populated, leaving a handler that branches on claims to take its no-claims path locally while AWS denied the request. The token named by the authorizer's identitySource is now verified against the pools in providerARNs and its claims reach the backend; a method carrying authorizationScopes requires one of them and answers 403 otherwise. PutMethod also stops discarding authorizationScopes. Contributed by @ppettitau.
• CloudFormation — the template and stack quotas are enforced — a template of any size, with any number of resources, parameters, outputs or mappings, and a stack name of any shape were accepted, so a template a real account refuses deployed. The body, resource, parameter, output and mapping limits and the stack-name pattern are now checked before a stack record exists, with the messages the API's parameter validation gives; ValidateTemplate also takes TemplateURL. Contributed by @iot-rocket.
• CloudFormation — Capabilities are enforced under AUTH=true — CreateStack, UpdateStack and CreateChangeSet accepted a template with IAM resources or a Transform whatever the request acknowledged, so a deploy CloudFormation refuses went through. With AUTH=true they now answer InsufficientCapabilitiesException and create nothing. Without AUTH nothing changes. Contributed by @iot-rocket.

Fixed

• EC2 — AvailabilityZoneId is populated on subnets — DescribeSubnets and CreateSubnet always returned null, even though DescribeAvailabilityZones reported the correct mapping, and a consumer that recomputes the id when it is missing (the AWS Load Balancer Controller) can crash on that fallback. The id is now derived from the zone on every creation path, subnets restored from older state are backfilled, and the two members always name the same zone. Contributed by @Alexis-DevOps.
• EC2 — DescribeAvailabilityZones reports ZoneType — the field was omitted entirely, so a consumer that branches on it read it as empty and refused to classify the subnet, blocking Service and Ingress reconciliation. Every zone now reports availability-zone. Contributed by @Alexis-DevOps.
• EC2 — CreateFleet applies a launch template's instance tags — instances created by a fleet came back with an empty Tags list even though the referenced launch template carried TagSpecifications, which is the mechanism AWS documents for tagging fleet instances. The template's instance tags now reach the instances, with a request-level tag winning on a duplicate key. Reported by @edersonbrilhante.
• Step Functions — numeric *Path Choice comparisons — NumericLessThanPath, NumericGreaterThanPath, NumericLessThanEqualsPath and NumericGreaterThanEqualsPath silently evaluated false, so a batch loop guarded by one never exited and eventually failed in States.ArrayGetItem. The four operators now resolve the right operand from the input and compare it. Contributed by @jayjanssen.
• SES — SendBulkEmail is routed — POST /v2/email/outbound-bulk-emails reached no handler, so the call failed instead of sending. It now routes to the v2 handler. Contributed by @jgrumboe.
• Glue — the Data Catalog operations — the catalog operations were missing, so a client that creates or reads a catalog before its databases could not proceed. Catalog create, read and update are served.

Internal

• CI — install with uv and collect test shards in one pass — the shard planner ran pytest --collect-only once per marker filter for counts a single pass already has, and superseded pull-request runs competed for runners. Installs go through uv, one collection pass yields both counts, and a concurrency group cancels superseded runs (never on main). No user-visible behavior changes. Contributed by @jgrumboe.
• Lint — F401 is enforced — unused imports were ignored repo-wide pending a manual review; the review is done, the rule is on, and the four dead imports it found are gone. No user-visible behavior changes.
• Testcontainers — containerd bumped to 1.7.35 in the Go example module, picking up CVE-2026-53495. No user-visible behavior changes.