ministackorg/ministack v1.5.28 on GitHub

What's Changed

New Contributors

@OS-kiranmalsetty made their first contribution in #2212

[1.5.28] — 2026-10-16

Added

RDS — DescribeEvents with reboot events — DescribeEvents returns the availability event DB instance restarted. once a RebootDBInstance has finished, filtered by source, source type, category and time, paged with Marker and kept for 14 days; other RDS lifecycle events are not recorded yet. Contributed by @jayjanssen.
S3 Control — Multi-Region Access Points — CreateMultiRegionAccessPoint, DeleteMultiRegionAccessPoint, PutMultiRegionAccessPointPolicy, DescribeMultiRegionAccessPointOperation, GetMultiRegionAccessPoint, GetMultiRegionAccessPointPolicy, ListMultiRegionAccessPoints, GetMultiRegionAccessPointRoutes and SubmitMultiRegionAccessPointRoutes. The async operations apply at once and Describe reports SUCCEEDED, or FAILED with AWS's ErrorDetails for a missing bucket, two buckets in one region or a name already in use. Management is served from us-west-2 and route operations from us-east-1, us-west-2, eu-west-1, ap-northeast-1 and ap-southeast-2, as on AWS; other regions get 301 PermanentRedirect. DeleteBucket on a member returns BucketHasAccessPointsAttached. Under AUTH=true each operation needs its s3: IAM action and x-amz-account-id must name the caller's account. Access points from AWS::S3::MultiRegionAccessPoint appear in the API. Contributed by @fabio-andre-rodrigues.
S3 — Multi-Region Access Point failover — a request through the MRAP host goes to the member with a traffic dial of 100 that is homed in MINISTACK_REGION, else the first active member. Setting a dial to 0 moves traffic to the other member, and an update that leaves every dial at 0 is refused. Contributed by @fabio-andre-rodrigues.
CloudFormation — DescribeEvents — returns the validation errors of a create that fails pre-deployment validation, which the stack's CREATE_FAILED event tells the caller to look up; every request member is optional. Contributed by @fabio-andre-rodrigues.
WAF v2 — regex pattern sets — CreateRegexPatternSet, GetRegexPatternSet, UpdateRegexPatternSet, DeleteRegexPatternSet and ListRegexPatternSets now manage regional and CloudFront-scoped regex pattern sets, with their ARN (regexpatternset), tags and LockToken checks on update and delete (WAFOptimisticLockException for a stale token), as AWS does. Web ACL and rule group rules are stored as sent, so a RegexPatternSetReferenceStatement pointing at a pattern set ARN round-trips; the statement is not evaluated, as MiniStack does not inspect requests. Contributed by @OS-kiranmalsetty.
IoT — job rollout rates — jobExecutionsRolloutConfig was stored but every execution was created at once; a job now creates maximumPerMinute executions a minute, or a rate that starts at baseRatePerMinute and grows by incrementFactor for every rateIncreaseCriteria step of notified or succeeded things, notifies each thing when its execution is created, reports isConcurrent until the last batch and stops when the job is canceled or deleted. Contributed by @iot-rocket.
Health — auth field — /_ministack/health reports "auth": "enabled" or "disabled", the effective AUTH mode. Contributed by @jgrumboe.
Auth — REST API resource policies are evaluated under AUTH=true — an API Gateway resource policy took no part in the decision; for an execute-api:Invoke a statement naming the calling user or role now allows the call without an identity policy, a statement naming only the account still needs one, a Deny wins over an identity Allow, and a call without a SigV4 signature (none, or a bearer token) to a method without authorization passes only when the policy, if any, allows everyone, else it answers ACCESS_DENIED with API Gateway's message. Contributed by @iot-rocket.
Auth — KMS key policies are evaluated under AUTH=true — a key policy took no part in the decision; it now has to allow even in the key's own account: a statement naming the calling user or role allows the call without an identity policy, identity policies count only when the key policy has a statement for the account (the default key policy does), and a Deny wins over an identity Allow. Contributed by @iot-rocket.
Auth — ECR repository policies count under AUTH=true — a repository policy took no part in the decision; a statement naming the calling user or role now allows the call without an identity policy, a statement naming only the account still needs one, and a Deny wins over an identity Allow. Contributed by @iot-rocket.
Auth — Secrets Manager resource policies count under AUTH=true — a secret's resource policy took no part in the decision; a statement naming the calling user or role now allows the call without an identity policy, a statement naming only the account still needs one, and a Deny wins over an identity Allow. Contributed by @iot-rocket.
Auth — Lambda function policies count under AUTH=true — an AddPermission statement naming the calling user or role did not let a caller without an identity policy in; it now allows the actions it names (InvokeFunction, GetFunction, ...), while a statement naming only the account still needs an identity Allow, and a call that names the function by ARN is checked against that ARN. Contributed by @iot-rocket.
Auth — bucket policies count under AUTH=true in the owner's account — a bucket policy was consulted only for another account's requests; in the owner's account a statement naming the calling user or role now allows the request without an identity policy, a statement naming only the account still needs one, and a Deny wins over an identity Allow, CDK's aws:SecureTransport Deny on the bootstrap bucket included. Contributed by @iot-rocket.
Auth — queue and topic policies count under AUTH=true — a queue or topic policy statement naming the calling user or role did not let a caller without an identity policy in; in the owner's account it now allows the call, a statement naming only the account still needs an identity Allow, and across accounts both have to allow. A denial answers AuthorizationError on SNS and reports AccessDenied to SDKs on SQS, its message says "with an explicit deny in a resource-based policy" when the resource's policy denied, and the check reads the queue of the account the QueueUrl names. Contributed by @iot-rocket.
IoT — EnableTopicRule and DisableTopicRule — both calls were missing (POST /rules/{ruleName}/enable answered Invalid ruleName), so a rule could only be switched off by replacing it; they now set ruleDisabled, which GetTopicRule and ListTopicRules report and which stops the rule from acting on matching publishes and Basic Ingest until it is enabled again. Contributed by @iot-rocket.
IoT — job documents from S3 — CreateJob and CreateJobTemplate read a documentSource (s3:// or an S3 object URL) from MiniStack's S3 once, at creation, where they stored a {"documentSource": "<url>"} placeholder. A missing bucket or object, an object that is not JSON or is over 32 KB and a URL that names no S3 host are refused with AWS's messages, and CreateJob refuses document together with documentSource. Devices get every job document re-serialized as AWS sends it, without spaces and without object members that are null, while GetJobDocument keeps the stored text. Contributed by @iot-rocket.
IoT — presigned URLs in job documents — devices got ${aws:iot:s3-presigned-url:<url>} and ${aws:iot:s3-presigned-url-v2:<url>} placeholders as written; the iot-jobs-data API and the MQTT jobs topics now replace each with a SigV4 presigned GET URL of MiniStack's S3, signed with a session of presignedUrlConfig.roleArn and valid for expiresInSec, and CreateJob and CreateJobTemplate refuse a placeholder without a role or an S3 object URL with AWS's messages. Contributed by @iot-rocket.
IoT — fleet provisioning by claim — CreateProvisioningClaim issues a five-minute claim certificate that the mTLS listener accepts until it expires, and a device connected with it (or with any registered certificate) gets a certificate from $aws/certificates/create/json and registers itself through $aws/provisioning-templates/<name>/provision/json: the template's parameters, Ref and Fn::Join are resolved, the thing is created or checked against its OverrideSettings, and the certificate is activated and attached to the thing and the template's policies, with AWS's replies and rejections on the requesting connection; with AUTH=true a claim connection is limited to the certificate topics and its own template's, as on AWS. Contributed by @iot-rocket.
IoT — pre-provisioning hook — RegisterThing over MQTT now invokes the template's preProvisioningHook Lambda before the template is resolved and applies its answer the way AWS does: parameterOverrides are merged into the device's parameters, allowProvisioning: false is rejected as AccessDenied, and a function that fails, answers in another shape, takes longer than six seconds or may not be invoked gets AWS's InvocationError or InvalidResult. CreateProvisioningTemplate and UpdateProvisioningTemplate check the hook like AWS (a Lambda function ARN, payload version 2020-04-01, no hook on JITP templates, and an invoke permission for iot.amazonaws.com that covers the template) and store the default payload version. Contributed by @iot-rocket.
IoT — provisioning template versions — CreateProvisioningTemplateVersion, ListProvisioningTemplateVersions, DescribeProvisioningTemplateVersion and DeleteProvisioningTemplateVersion answered Unsupported IoT path and UpdateProvisioningTemplate refused every defaultVersionId but 1; a template now keeps up to five versions whose ids are never reused, setAsDefault and defaultVersionId choose the version that DescribeProvisioningTemplate returns and RegisterThing applies, the default version cannot be deleted, and an AWS::IoT::ProvisioningTemplate whose TemplateBody changes gets a new default version (deleting the oldest at the limit), all with AWS's errors, including its message for a body that is not JSON. Contributed by @iot-rocket.
Cognito — UpdateUserPoolDomain and AWS::Cognito::UserPoolDomain stack updates — UpdateUserPoolDomain was an unknown action; it now changes a domain's ManagedLoginVersion and a custom domain's certificate, CreateUserPoolDomain and DescribeUserPoolDomain return the version, and a second prefix domain on a pool is refused as on AWS. A stack update applies ManagedLoginVersion and CustomDomainConfig through it instead of running the create again, a Domain or UserPoolId change replaces the domain, the create keeps CustomDomainConfig, Ref returns the domain name and Fn::GetAtt returns CloudFrontDistribution. Contributed by @iot-rocket.
CloudFormation — SES configuration set updates — AWS::SES::ConfigurationSet and AWS::SES::ConfigurationSetEventDestination stored none of their options, tags or destinations, and a change re-ran the create; both now provision through the SES v2 calls and update in place, a removed option goes back to its default as on AWS, and only a Name or ConfigurationSetName change replaces them. Contributed by @iot-rocket.
SES v2 — configuration set options and event destinations — GetConfigurationSet returned only the name and the tags given at creation; it now returns the tracking, delivery, reputation, sending, suppression, VDM and archiving options that CreateConfigurationSet and the seven PutConfigurationSet*Options calls set, and a call clears the members it leaves out, as on AWS. CreateConfigurationSetEventDestination, GetConfigurationSetEventDestinations, UpdateConfigurationSetEventDestination and DeleteConfigurationSetEventDestination are new. CreateConfigurationSet with a name already in use is refused with AlreadyExistsException instead of replacing the set. Contributed by @iot-rocket.
IoT — job abort criteria — a job's abortConfig was stored but never acted on; once a device report, a CancelJobExecution, a DeleteJobExecution or a timeout meets one of its criteria, the job is now canceled with reasonCode ABORT_CANCEL and AWS's comment, together with its QUEUED executions. CreateJob and CreateJobTemplate stored any abortConfig; they now refuse what UpdateJob refuses, and all three refuse a missing criterion member, a threshold of 0 or less or with more than two decimals, and a failure type given twice. A CancelJob without force now reports forceCanceled as false. Contributed by @iot-rocket.

Changed

RDS — real instance reboot — RebootDBInstance now returns rebooting, stops and starts its backing database container, and waits for SQL readiness before reporting available. Data and endpoint bindings are preserved. An instance that is not available answers InvalidDBInstanceState, and a Docker failure reports failed rather than a successful reboot. Contributed by @jayjanssen.

Fixed

CloudFront — function status follows publish and association — DescribeFunction and ListFunctions reported the DEVELOPMENT stage as UNPUBLISHED even after PublishFunction, so Terraform's aws_cloudfront_function.status, which reads that stage, never left UNPUBLISHED; once the current development version is published it now reports UNASSOCIATED, or DEPLOYED while a distribution's cache behavior references the function, and an UpdateFunction makes it UNPUBLISHED again until the next publish. Contributed by @fabio-andre-rodrigues.
S3 — bucket home region is enforced — a request signed for a region other than the bucket's now returns 301 PermanentRedirect with x-amz-bucket-region, which SDKs follow; at the bucket's own regional endpoint it returns 400 AuthorizationHeaderMalformed or, presigned, AuthorizationQueryParametersError, with <Region>. HEAD gets the bodiless forms. GetBucketLocation, ListBuckets, CreateBucket, unsigned, SigV2 and SigV4a requests, MRAP requests and internal callers are exempt, and CopyObject from a source in another region still works. Contributed by @fabio-andre-rodrigues.
S3 — CreateBucket location constraint (breaking) — a request signed for a region other than us-east-1 must name that region as LocationConstraint, or gets IllegalLocationConstraintException; LocationConstraint=us-east-1 returns InvalidLocationConstraint. Clients that created buckets in another region without a constraint now need one. BucketAlreadyOwnedByYou and BucketAlreadyExists carry AWS's message and <BucketName>. Contributed by @fabio-andre-rodrigues.
S3 — ListBuckets bucket-region filter — BucketRegion lists only that region's buckets, with pagination inside the filter; a filter for another region than the endpoint's returns InvalidArgument. Contributed by @fabio-andre-rodrigues.
S3 — replication — delete markers replicate for V1 rules (no Filter) and for V2 rules with DeleteMarkerReplication enabled and no tag filter, from DeleteObject and DeleteObjects; version-id deletes don't. Rules with Filter.Tag or Filter.And.Tags replicate only objects carrying those tags. Contributed by @fabio-andre-rodrigues.
SigV4a requests no longer land in region s3 — the region was read from a credential scope that SigV4a doesn't have; a single-region X-Amz-Region-Set is used, else the default region. Contributed by @fabio-andre-rodrigues.
Lambda — S3 code from another region — CreateFunction, UpdateFunctionCode, PublishLayerVersion and CloudFormation return AWS's InvalidParameterValueException when the code bucket is homed elsewhere. Contributed by @fabio-andre-rodrigues.
Resource Groups Tagging — S3 buckets by region — GetResources, GetTagKeys and GetTagValues list only buckets homed in the region they are called in. Contributed by @fabio-andre-rodrigues.
CloudFormation — User Initiated on stack events — the stack's CREATE_IN_PROGRESS and UPDATE_IN_PROGRESS events of CreateStack and UpdateStack carried no reason; they now carry User Initiated, as AWS does.
CloudFormation — AWS::S3::Bucket and existing names — an AWS::S3::Bucket whose BucketName already exists, in this account or another, was adopted (another account's became a second bucket of that name); it now fails pre-deployment validation with NAME_CONFLICT_VALIDATION, or with DisableValidation the resource's create with <name> already exists, as on AWS, and auto-named buckets get a new name for each stack instance. CreateStack, UpdateStack and CreateChangeSet take DisableValidation, and an update now runs the same pre-deployment validation, ending in UPDATE_ROLLBACK_COMPLETE without touching a resource (a bucket the stack already owns is not a conflict). With rollback disabled, a failed validation emits AWS's second CREATE_FAILED event (breaking: a stack no longer adopts a bucket left over from an earlier stack or an S3-only restore). Contributed by @fabio-andre-rodrigues.
AppSync — GraphQL requests on the API's own host — a POST /graphql to {apiId}.appsync-api.{region}.{host}, the endpoint uris.GRAPHQL reports, was routed to AppSync Events when unsigned and found its API only by x-api-key when signed, so an AWS_IAM API could not be called there once a second API existed; the host label now selects the API (in the host's region for an unsigned request) and /graphql on an Event API host answers 404 ResourceNotFoundException, as on AWS. Contributed by @iot-rocket.
Cognito — no ID token without openid — the /oauth2/token authorization code and refresh token grants returned an id_token whatever was granted; they now return one only when the grant carries openid, as AWS does, and a refresh token from InitiateAuth or AdminInitiateAuth still gets one. Contributed by @iot-rocket.
Cognito — token endpoint access tokens carry the granted scopes — /oauth2/token wrote aws.cognito.signin.user.admin into every access token whatever was granted; the authorization code, client credentials and refresh token grants now write the requested scopes the app client allows (all of them when none are requested, only resource server scopes for client credentials) in the order AWS lists them, refreshed tokens keep the original scopes, and the pre token generation event's request.scopes lists them, so API Gateway scope checks decide as on AWS. Contributed by @iot-rocket.
S3 — object ACL grants answer another account's read — a bucket owned by another account refused every read that only the object ACL granted: the ACL was looked up under the wrong version, and a grant to the caller's canonical ID was never read. With ACLs enabled, a READ grant to the account or a group now opens GetObject and HeadObject of the version it was set on, ?versionId= included, and READ_ACP opens GetObjectAcl; a grant to one account is not public, so Block Public Access leaves it in force. Contributed by @iot-rocket.
CloudWatch — DescribeAlarms and DescribeAlarmHistory paging — both returned at most MaxRecords items (default 100) and never a NextToken, so a paginator stopped after the first page; they now return a NextToken while more items match, default to 50 items and refuse a MaxRecords outside 1 to 100 with ValidationError. DescribeAlarms now lists metric and composite alarms in one name-ordered sequence that MaxRecords counts together, and DescribeAlarmHistory lists the newest items first unless ScanBy is TimestampAscending. DescribeAlarms without AlarmTypes now returns metric alarms only, as on AWS; composite alarms need AlarmTypes=["CompositeAlarm"]. Contributed by @iot-rocket.
CloudWatch Logs — a log group's resource policy by resourceArn alone — PutResourcePolicy and DeleteResourcePolicy refused a resourceArn without policyName; they now take it, store the group's policy without a name and with a counting revisionId, and answer a request with neither field or a revision conflict with AWS's errors. AWS::Logs::LogGroup now creates, rewrites and removes the group's own policy from ResourcePolicyDocument. Contributed by @iot-rocket.
CloudTrail — trail read-backs and recording switched on at runtime — GetTrail and DescribeTrails returned the stored IsLogging, _StartedAt and _StoppedAt keys and empty S3KeyPrefix and SnsTopicName members, and GetTrailStatus left out the six deprecated string members and moved StopLoggingTime when a stopped trail was stopped again; they now answer in AWS's shapes, with the start and stop times in milliseconds, and keep the last stop time. Recording switched on through /_ministack/config began only after the first CloudTrail API call and now starts with the next request. Contributed by @iot-rocket.
ACM / Signer — certificate key and in-use refusals — ImportCertificate accepted a call without a PrivateKey and now answers AWS's ValidationException; DeleteCertificate removed a certificate an Active Signer signing profile uses and now answers ResourceInUseException, with those profiles listed in DescribeCertificate's InUseBy; CancelSigningProfile answered 200 with {} and now answers 204 with an empty body, as on AWS. Contributed by @iot-rocket.
IoT — not-found messages match AWS — a call naming a thing, thing type, thing group, certificate, CA certificate, principal, policy, policy version, job, job execution, job target or provisioning template that does not exist answered ResourceNotFoundException with a generic <Resource> '<name>' not found, and the device jobs plane (HTTP and MQTT /rejected) with No job execution found for thing … and job …; each now carries the wording AWS uses for that operation, with the same error code and status. Contributed by @iot-rocket.
IoT Jobs — terminal job executions on the device plane — a device's DescribeJobExecution (HTTP and the MQTT get topic) of a SUCCEEDED, FAILED, REJECTED, TIMED_OUT, CANCELED or REMOVED execution answered with the execution; it now answers TerminalStateException (410) and TerminalStateReached over MQTT, as AWS does. UpdateJobExecution and CancelJobExecution of a terminal execution now refuse with AWS's messages (over MQTT InvalidStateTransition with the executionState), a refused status such as QUEUED is checked first, and a device that reports SUCCEEDED or FAILED straight from QUEUED now stamps startedAt. Contributed by @iot-rocket.
IoT / CloudFormation — stack tags and provisioning templates — stack-level tags never reached IoT resources; they now reach thing types, thing groups, policies, topic rules, CA certificates and provisioning templates without the aws:cloudformation: tags (job templates get none, as on AWS), and an update that only changes tags no longer adds a policy version. An AWS::IoT::ProvisioningTemplate Enabled of "false" from a parameter or the template enabled the template; it now disables it. CreateProvisioningTemplate and the CloudFormation type accepted any certificate resource; they now refuse one without a Status of Active or Inactive (any case) or whose CertificateId is not a reference to AWS::IoT::Certificate::Id, a second certificate resource and a resource without Properties, with AWS's messages. Contributed by @iot-rocket.
IoT — device certificates take the mode of their CA — a device certificate registered under a CA in SNI_ONLY mode, with or without caCertificatePem, or created by just-in-time registration reported certificateMode DEFAULT; it now takes its CA's mode, and RegisterCertificateWithoutCA stays SNI_ONLY. Contributed by @iot-rocket.
IoT — deletes of unknown resources and DeleteThing expectedVersion — DeleteThing, DeleteThingType, DeleteThingGroup, RemoveThingFromThingGroup with an unknown group and DetachPolicy with an unknown policy answered ResourceNotFoundException, and DeleteThing ignored expectedVersion; they now answer 200 as AWS does, and DeleteThing refuses a wrong expectedVersion with VersionConflictException before the attached-principal check. Contributed by @iot-rocket.
CloudFormation — IoT policy and thing type deletes check what still uses them — a stack delete removed an AWS::IoT::Policy or AWS::IoT::ThingType directly, even while a certificate outside the stack had the policy attached or a thing used the type; the policy delete now removes the non-default versions and then calls DeletePolicy, the thing type delete deprecates the type and then calls DeleteThingType, so a resource still in use fails its delete with the service's message and the stack ends in DELETE_FAILED, as on AWS. Contributed by @iot-rocket.
IoT — MQTT 5 message expiry — the broker forwarded the Message Expiry Interval unchanged and never expired a message; a subscriber now receives the seconds left (60 arrives as 59, 0 counts as 1, intervals above seven days are capped at 604800), an expired retained message is no longer replayed to new subscribers or returned by GetRetainedMessage and ListRetainedMessages, and a QoS 1 message queued for an offline persistent session is dropped once it expires (the queue also keeps the MQTT 5 properties now). Contributed by @iot-rocket.
IoT — HTTP Publish keeps the MQTT 5 properties and a literal % in the topic — Publish ignored userProperties, payloadFormatIndicator, contentType, responseTopic, correlationData and messageExpiry, so MQTT 5 subscribers got none of them and GetRetainedMessage returned no userProperties; they now reach subscribers and the retained message, and invalid values are refused with AWS's InvalidRequestException messages. Publish, GetRetainedMessage and the AUTH=true topic ARN decoded the topic a second time, so p%41q became pAq; the topic is now kept as sent. /_ministack/reset kept messages retained over MQTT when no iot-data call had loaded that module; it now clears them. Contributed by @iot-rocket.
IoT Core — MQTT 5 PUBACK reports Success without subscribers — a QoS 1 PUBLISH that no subscriber matched (including a topic only a rule reads, Basic Ingest and a retained publish) was acknowledged with reason code 0x10 No matching subscribers; it now gets 0x00 Success, as AWS IoT answers over both MQTT over TLS and MQTT over WebSocket. Contributed by @iot-rocket.
CloudFormation — AppSync data sources and resolvers keep their configuration — AWS::AppSync::DataSource dropped Description, HttpConfig and EventBridgeConfig and stored DynamoDBConfig and LambdaConfig in the template's PascalCase, and AWS::AppSync::Resolver dropped Kind, Runtime, Code, PipelineConfig and MaxBatchSize, so a DynamoDB resolver from a stack answered null and an APPSYNC_JS resolver never ran; both now go through CreateDataSource and CreateResolver and read back as on AWS, and a new data source Name or resolver TypeName or FieldName is reported as a replacement. GetDataSource and GetResolver leave out a description, service role or mapping template that was never set, a DynamoDB data source reports useCallerCredentials and versioned, an EventBridge one keeps eventBridgeConfig, and a resolver reports maxBatchSize. Contributed by @iot-rocket.
CloudFormation — AWS::AutoScaling::LifecycleHook updates — a stack update ran the create again, so a member dropped from the template went back to its default and a hook with a generated name moved to another group stayed on the old group too; the hook now updates in place and keeps a dropped member, and an AutoScalingGroupName or LifecycleHookName change replaces it. NotificationMetadata is stored and returned by DescribeLifecycleHooks, and a group deleted by its stack takes its lifecycle hooks along. Contributed by @iot-rocket.
IoT — mTLS refusals close without a CONNACK under AUTH=true — with AUTH=true the mTLS listener closes the connection of an unknown, inactive, revoked or doubly-registered client certificate after its CONNECT without sending a CONNACK, as AWS does on MQTT 3.1.1 and 5; without AUTH it still answers a "not authorized" CONNACK, and the log names the reason either way. Contributed by @iot-rocket.
IoT — AttachPolicy to a target that does not exist — AttachPolicy and AttachPrincipalPolicy accepted any target string; they now answer ResourceNotFoundException for an unknown certificate or thing group, InvalidRequestException for anything else that is not a certificate, a thing group (AttachPolicy only) or a Cognito identity id, and AccessDeniedException for another account's certificate, which also fails an AWS::IoT::PolicyPrincipalAttachment naming such a principal. Contributed by @iot-rocket.
IoT — SetDefaultPolicyVersion — the call was missing (PATCH /policies/{policyName}/version/{policyVersionId} answered Unsupported policy path), so only CreatePolicyVersion with setAsDefault could move a policy's default version; it now sets the default that GetPolicy, GetPolicyVersion, ListPolicyVersions and the MQTT policy evaluation under AUTH=true use, deleting the default version answers DeleteConflictException (409) instead of 400, and ListPolicyVersions lists the newest version first. Contributed by @iot-rocket.
STS — session policies and GetFederationToken — AssumeRole ignored Policy and PolicyArns and GetFederationToken answered InvalidAction; under AUTH=true a role session now gets only what both the role and its session policies allow, a Deny in them denies, and AssumeRole rejects a malformed policy with MalformedPolicyDocument and an unknown policy ARN with ValidationError. GetFederationToken is added: its federated user gets the calling user's permissions within the session policies (none without one) and its Tags, not the user's tags, as aws:PrincipalTag/*; it checks its Name, policies and tags, and under AUTH=true a temporary caller answers AccessDenied. Contributed by @iot-rocket.
IAM — permissions boundaries are enforced — the boundaries of users and roles were stored and never applied; under AUTH=true a boundary now limits what the identity policies allow and a Deny in it denies, a boundary must name a known managed policy (ValidationError for a malformed ARN, CloudFormation AWS::IAM::User included), deleting an absent boundary answers NoSuchEntity, and a policy in use as a boundary cannot be deleted. ListUsers and ListRoles leave the boundary out, ListEntitiesForPolicy lists boundary users and roles and honours PolicyUsageFilter, and a managed policy reports PermissionsBoundaryUsageCount. Contributed by @iot-rocket.
API Gateway — GetExport includes Lambda authorizers — a REST API export had no security scheme for a TOKEN or REQUEST authorizer and no security field on its methods, so tools such as Swagger UI showed no "Authorize" button. Each authorizer that a CUSTOM method uses is now a scheme in components.securitySchemes (OAS 3.0) or securityDefinitions (Swagger 2.0), and the method has security. With extensions=authorizers or extensions=apigateway, the scheme also has the x-amazon-apigateway-authorizer block. Checked against a real AWS export and the x-amazon-apigateway-authorizer docs. Contributed by @mishukdutta-cz.
STS — trust policies see principal tags, session tags and web identities under AUTH=true — AssumeRole trust conditions had no aws:PrincipalTag/*, a Service principal matched any IAM user whose ARN contained the service name, Tags passed without sts:TagSession in the trust policy, and AssumeRoleWithWebIdentity skipped the trust policy; trust conditions now see the caller's keys and the session tags as aws:RequestTag/* and aws:TagKeys, a Service principal no longer matches an IAM user, session tags need sts:TagSession, and a web identity needs a Federated principal naming its issuer, with <issuer>:aud, :sub and :amr evaluated. Under AUTH=true session tag keys that differ only in case answer InvalidParameterValue. Contributed by @iot-rocket.
IAM — aws:ResourceTag/* under AUTH=true — the key was always absent outside CloudWatch Logs, so a tag-scoped grant denied every request; a request on an existing SQS queue, SNS topic, DynamoDB table, Lambda function, IAM user or role, SSM parameter, Secrets Manager secret or KMS key now sees that resource's tags. Contributed by @iot-rocket.
IAM — aws:RequestTag/* and aws:TagKeys under AUTH=true — only CloudWatch Logs filled them; a call whose API takes Tags or TagKeys (create, tag and untag calls such as CreateQueue, CreateTable, CreateUser, PutParameter, CreateSecret, CreateKey) now carries the tags it sets and the keys it names, aws:TagKeys is absent on a call that names none, and Lambda TagResource, UntagResource and ListTags are authorized against the ARN in the path instead of skipped. Contributed by @iot-rocket.
IAM — caller and transport condition keys under AUTH=true — identity policies saw none of the caller's keys and a fixed 127.0.0.1 over plain HTTP; they now see aws:username, aws:userid, aws:PrincipalTag/* (the user's or role's tags, AssumeRole session tags taking precedence; in rds-db:connect too), for temporary credentials aws:MultiFactorAuthPresent and aws:TokenIssueTime, the client's address as aws:SourceIp and aws:SecureTransport as true over HTTPS or behind a proxy that sends X-Forwarded-Proto: https, and AssumedRoleId starts with the role's RoleId with or without AUTH. Contributed by @iot-rocket.
S3 — requests without credentials are anonymous under AUTH=true — an unsigned request (no Authorization header, presigned query or POST form credential) ran as the root key, so a private bucket in the caller's own account answered 200 to anyone; it is now anonymous, and only the owner's public grants let it in: an AllUsers ACL grant or a bucket policy that allows *, unless Public Access Block shuts them off. Anything else answers 403 AccessDenied. A public-read object ACL is now also found for an unversioned object, which the grant check missed for cross-account callers too. Without AUTH nothing changes. Contributed by @prandogabriel.
Cognito — InboundFederation userName — the trigger received <provider>_<NameID> for SAML and <provider>_<sub> for OIDC; it now receives the bare SAML NameID or OIDC sub. Contributed by @kjdev.
S3 Tables — CreateTable keeps Iceberg column types — a schema or schemaV2 field type other than string, int, long, boolean, date, timestamp, float or double was stored as string, and timestamp as timestamptz; every Iceberg v2 type, nested list, struct and map included, is now stored as AWS stores it (lowercase, decimal(P, S)), and any other type answers BadRequestException The specified metadata is not valid. Reported by @anatollius.
S3 Tables — the Iceberg REST catalog takes the table bucket prefix — a request without the {prefix} searched every table bucket, so two buckets with the same namespace and table name answered with the first one; such a request now answers 404 <UnknownOperationException/>, GET /v1/config without a table bucket ARN warehouse answers 400 The specified table bucket ARN is not valid., and the url-encoded ARN comes back as prefix in defaults.