ministackorg/ministack v1.5.37

on GitHub

What's Changed

[1.5.37] — 2026-11-03

Added

• Glue — table optimizers — CreateTableOptimizer, GetTableOptimizer, UpdateTableOptimizer, DeleteTableOptimizer, BatchGetTableOptimizer and ListTableOptimizerRuns answered InvalidAction. Optimizers are now stored per Iceberg table and type with AWS's defaults and errors, and dropping a table or database removes them. They never run. Reported by @lucasmfraser.
• ALB — hosts resolve through Route 53 alias records — the data plane found a load balancer only by its DNSName or <name>.alb.localhost. A host with an A/AAAA alias record in a public hosted zone, exact or wildcard (*.example.com, the most specific name winning), now reaches the load balancer the record targets, so one ALB can serve many hostnames. Reported by @boesing.
• Testcontainers — .NET example — Testcontainers/dotnet-testcontainers runs MiniStack from Testcontainers for .NET with the AWS SDK for .NET.

Fixed

• ElastiCache — user groups reach the engine — user groups on a replication group or serverless cache were never applied, so commands ran as the open default user. The users now reach the engine on every change, default is off unless a group has one, and users can't run ACL writes or CONFIG. A change restarts the engine, dropping open connections. Contributed by @chris-plucker. Reported by @kharabasz.
• ElastiCache — user group members and the built-in default user — ModifyUserGroup and CreateUserGroup accepted current members, non-members, unknown users and duplicates; they now refuse them in AWS's order and messages. Every account has the built-in default user, which "can't be modified." or "can't be deleted.", and DeleteUser takes a user out of its groups. Reported by @kharabasz.
• ElastiCache — user channels and & in access strings — a user with a selector and no top-level channel rule, such as on ~* +@all (+get ~k), got every channel outside its selectors; it now gets none, as on AWS. Responses escape & and every other value, which botocore could not parse. Contributed by @kharabasz.
• ElastiCache — a Redis OSS user group needs a default user — CreateUserGroup and ModifyUserGroup accepted a Redis group with no user named default; they now answer DefaultUserRequired "Redis user group needs to contain a user with the user name default." ModifyUserGroup also applies an Engine change to valkey, which lifts the rule. Contributed by @kharabasz.
• ElastiCache — ModifyUser applies AppendAccessString — the appended rules were ignored. They are now applied, the result stored with rules ordered and merged; refused rules answer InvalidParameterValue, and sending it with AccessString answers InvalidParameterCombination "Both AccessString and AppendAccessString provided together. Pass either one of them." Contributed by @kharabasz.
• CloudFormation — AWS::ElastiCache::UserGroup updates and ElastiCache failures — an update changing the users or Engine leaves the group with exactly the template's users; one changing only tags or order keeps changes made outside the stack. A user listed twice fails validation ("#/UserIds: array items are not unique"). Failures read Resource handler returned message: "<message> (Service: ElastiCache, …)", as on AWS. Contributed by @kharabasz.
• DynamoDB — a value SET at several paths is stored once per path — SET a = :v, b = :v, SET a = src, b = src, if_not_exists, list_append(:l, :l) and PartiQL UPDATE ... SET stored one shared value, so a later nested write to one path showed up at the others. Each path now gets its own copy. Contributed by @toby6578.
• ECS — task definition secrets — AWS::ECS::TaskDefinition converted only a few container fields, so Secrets were never injected and RuntimePlatform and EphemeralStorage were dropped; every nested property now reaches the ECS API's form. An SSM SecureString secret reaches the container decrypted, not as its stored ENCRYPTED: form. Reported by @dimazuien.
• ECS — tasks run images from MiniStack's own ECR — a task whose image was a MiniStack ECR repositoryUri was pulled from the real *.dkr.ecr.*.amazonaws.com host. ECS now loads it from MiniStack's registry for the host's platform, and under AUTH=true another account's repository needs a policy allowing the pull. Reported by @kharabasz.
• CloudFormation — a secretsmanager dynamic reference reads a secret in another account — a reference by ARN looked only in the stack's account. It now resolves in the account the ARN names, and under AUTH=true only when the secret's policy and its customer managed KMS key allow the caller, as on AWS. Contributed by @mishukdutta-cz.
• CloudFormation and Lambda — files in another account's bucket — a TemplateURL, a nested stack, an AWS::Include Location, a state machine DefinitionS3Location or Lambda code and layers in a bucket another account owns were looked for only in the caller's account. They are now read when the owner's bucket ACLs or policy allow it, as an S3 GetObject would be. Contributed by @mishukdutta-cz.
• Lambda — a declared architecture pins the container platform — a CloudFormation or SAM function ran on the host's platform whatever its Architectures said. It now runs the declared platform; a host that cannot run it falls back once and remembers, and --platform in LAMBDA_DOCKER_FLAGS wins. Contributed by @toby6578.
• Lambda — cold starts — the tar copied into a new container stayed in memory until a full garbage collection, so bursts of cold starts grew MiniStack by hundreds of MB; it is now freed when the copy ends. Concurrent cold starts of one function no longer collide on the context-ARN shim. Contributed by @skialpine. Reported by @chandra-purbia.
• Containers — failed and abandoned ones are cleaned up — a Lambda container whose start failed after create was left behind, and a Docker timeout was taken for an unrunnable platform. Stopped Lambda, Glue, CodeBuild, DSQL and AgentCore containers are now reaped, and spawned containers carry MiniStack's Testcontainers session labels so Ryuk can remove them. Contributed by @kharabasz.
• EC2 — port ranges are ignored where the protocol covers all ports — the Terraform provider revokes a new group's default egress rule as -1 with ports 0, which matched nothing, so a later allow-all rule lost its description and tags. -1 and protocols other than tcp, udp, icmp and icmpv6 now ignore FromPort/ToPort, as botocore documents. Contributed by @kharabasz.
• RDS — cluster endpoints — under MINISTACK_RDS_PUBLIC_ENDPOINT, a cluster's endpoints and port changed with its first instance, so Terraform showed drift; they are now reported from CreateDBCluster. The global writer endpoint now resolves to the writer on the Docker network, follows switchover, failover, rename and removal, and is in every PostgreSQL member's certificate. Contributed by @kharabasz.
• Step Functions — Map states — a JSONata Distributed Map now evaluates Items, ItemSelector, MaxConcurrency and Output, and ItemBatcher gives each child one batch as {"BatchInput", "Items"}, up to 256 KiB by default. An Inline Map with ItemReader, ItemBatcher or ResultWriter fails with States.Runtime ("…not supported for INLINE maps"), which no Catch or Retry handles, as on AWS. Contributed by @mishukdutta-cz.
• Step Functions — stops and .sync children — after StopExecution, a Wait kept sleeping and branches kept running, so events landed after ExecutionAborted; nothing follows it now. A failed, stopped or timed-out .sync child fails the parent with States.TaskFailed and the child's DescribeExecution as the cause, as on AWS. Contributed by @mishukdutta-cz.