ministackorg/ministack v1.5.31

on GitHub

What's Changed

New Contributors

• @kharabasz made their first contribution in #2303
• @Xevos117 made their first contribution in #2329
• @jun-ut made their first contribution in #2332
• @toby6578 made their first contribution in #2334
• @vanessah07 made their first contribution in #2337

[1.5.31] — 2026-10-21

Added

• CloudFront — VPC origins and distribution web ACLs — CreateVpcOrigin, GetVpcOrigin, UpdateVpcOrigin, DeleteVpcOrigin and ListVpcOrigins are implemented: a change answers Deploying and the next read shows Deployed, the endpoint must be a load balancer or instance that exists in MiniStack, and an origin a distribution names can't be deleted or changed (CannotDeleteEntityWhileInUse, CannotUpdateEntityWhileInUse). AssociateDistributionWebACL and DisassociateDistributionWebACL set and clear the distribution's WebACLId, with If-Match and EntityNotFound as on AWS. Contributed by @kharabasz and @OS-kiranmalsetty.
• Cognito — auth events — on a pool with threat protection on, password, SRP and admin sign-ins, their MFA answers and password changes are logged as SignIn and PasswordChange events, AdminListUserAuthEvents lists them newest first, and AdminUpdateAuthEventFeedback and UpdateAuthEventFeedback are implemented. Contributed by @iot-rocket.
• Route 53 — private hosted zones — CreateHostedZone with a VPC made a public zone and dropped the VPC; the zone is now private and keeps its VPCs, and AssociateVPCWithHostedZone, DisassociateVPCFromHostedZone and ListHostedZonesByVPC are implemented with AWS's refusals (PublicZoneVPCAssociation, ConflictingDomainExists, VPCAssociationNotFound, LastVPCAssociation). A Cloud Map private DNS namespace's zone carries the namespace VPC. Contributed by @kharabasz.

Fixed

• S3 — access points — under AUTH=true a request through an access point alias or ARN is now checked on both the access point and its bucket, with s3:DataAccessPointArn, s3:DataAccessPointAccount and s3:AccessPointNetworkOrigin, and the access point's Block Public Access settings apply to requests through it (BlockPublicAcls refuses a public ACL with 403 AccessDenied). Contributed by @iot-rocket.
• S3 Control — access point, Object Lambda and Multi-Region Access Point requests authorize the operation they run — the IAM action was read from the path separately from the handler, so an extra segment, a double slash or a resource named policy ran an operation without its action; the action now comes from the route served, a method a resource lacks answers 405 MethodNotAllowed and an unparseable path 400 InvalidURI. Contributed by @iot-rocket.
• S3 — replication rule options — PutBucketReplication dropped SourceSelectionCriteria, EncryptionConfiguration, ReplicationTime and Metrics; they are now stored, returned and validated with AWS's codes and order (MalformedXML, InvalidArgument, InvalidRequest). Contributed by @kharabasz.
• S3 — EU location constraint — eu-west-1 accepts the legacy EU constraint again and homes the bucket in eu-west-1, GetBucketLocation answers EU for it, and other regional endpoints still refuse it. Contributed by @toby6578.
• CloudFormation — S3 bucket CORS, Block Public Access and website — AWS::S3::Bucket dropped CorsConfiguration, PublicAccessBlockConfiguration and WebsiteConfiguration; they are now stored on create, replaced on update and deleted when an update removes them. Contributed by @iot-rocket.
• Lambda — Node.js functions — under USE_SSL=1 Node requests to the gateway keep TLS on the gateway port in both executors, so cfn-response callbacks and SDK calls work, and the generated certificate names host.docker.internal. The local executor's SDK stubs now sign with the function's credentials, so a call lands in the function's account and runs as its execution role. Contributed by @iot-rocket.
• ELBv2 — listener TLS settings and rule transforms — HTTPS and TLS listeners keep SslPolicy (default ELBSecurityPolicy-2016-08) and their certificate, and more than one certificate answers TooManyCertificates (Up to '1' certificate ARNs can be specified, but '2' were specified). Rules keep their url-rewrite and host-header-rewrite Transforms, validated as AWS does, also from AWS::ElasticLoadBalancingV2::ListenerRule. Contributed by @kharabasz.
• Cognito — trigger events and user errors — the pre token generation event carries its version, TokenGeneration_NewPasswordChallenge and ClientCredentials, and every trigger's awsSdkVersion is aws-sdk-unknown-unknown. Unknown users answer User does not exist. (Username/client id combination not found. on the client calls with PreventUserExistenceErrors LEGACY), and ChangePassword checks PreviousPassword. Contributed by @iot-rocket and @jun-ut.
• Step Functions — encryption and aws-sdk:ec2 snapshots — state machines keep and validate encryptionConfiguration (AWS_OWNED_KEY when unset, a 300-second key reuse period by default), also in AWS::StepFunctions::StateMachine, and aws-sdk:ec2 snapshot results name their lifecycle State. Contributed by @kharabasz and @bandle.
• SQS — message digests — a FIFO dedup hit answers the current request's MD5OfMessageBody and MD5OfMessageAttributes, and ReceiveMessage computes MD5OfMessageAttributes over the attributes it returns, so SDKs that verify them no longer fail. Contributed by @vanessah07 and @Xevos117.
• EventBridge — archive KMS keys — CreateArchive and UpdateArchive keep KmsKeyIdentifier and DescribeArchive returns it; ListArchives entries carry only the Archive summary fields. Contributed by @kharabasz.
• WAF v2 — duplicate names — CreateIPSet and CreateRuleGroup refuse a name already used in the scope, and all four creates answer WAFDuplicateItemException with AWS WAF couldn’t perform the operation because some resource in your request is a duplicate of an existing one. Contributed by @OS-kiranmalsetty.
• IoT — # does not match the level above it — a filter ending in /# no longer receives messages published to the level above it, as on AWS IoT Core. Contributed by @iot-rocket.
• SSM — public latest Amazon Linux AMI parameters — /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 and the Amazon Linux 2 parameter resolve, also as CloudFormation AWS::SSM::Parameter::Value<AWS::EC2::Image::Id> defaults. Contributed by @bandle.
• Athena — CSV tables with DuckDB 2.0 — DuckDB 2.0's type_pushdown optimizer made the CSV reader's TRY_CAST strict, failing queries on values of another type; it is disabled on the Athena connection.