ministackorg/ministack v1.5.38

on GitHub

What's Changed

New Contributors

• @bpmiranda3099 made their first contribution in #2594

[1.5.38] — 2026-11-05

Added

• RDS — IAM database authentication for PostgreSQL and Aurora PostgreSQL — a role granted rds_iam could not log in with a token from generate_db_auth_token. With IAM database authentication enabled it now logs in with one, checked as for MySQL (with AUTH=true also the token and rds-db:connect); other users keep password authentication. Reported by @kharabasz.
• Cognito — refresh token rotation — a client with RefreshTokenRotation ENABLED now gets a new refresh token from GetTokensFromRefreshToken and /oauth2/token. Reusing a replaced token outside RetryGracePeriodSeconds answers RefreshTokenReuseException, and REFRESH_TOKEN_AUTH answers UnsupportedOperationException for such a client. Contributed by @toby6578.
• Cognito — the CustomEmailSender trigger — LambdaConfig.CustomEmailSender was stored and never invoked. It now receives invitation, sign-up, resend, forgot-password and email OTP messages with AWS's event, the code encrypted as an AWS Encryption SDK message under the pool's KMSKeyID, so it decrypts through MiniStack's KMS. Contributed by @toby6578.
• Cognito — managed login branding — CreateManagedLoginBranding, DescribeManagedLoginBranding, DescribeManagedLoginBrandingByClient, UpdateManagedLoginBranding and DeleteManagedLoginBranding answered InvalidAction. A branding is now kept per app client with AWS's checks in AWS's order, and AWS::Cognito::ManagedLoginBranding deploys in CloudFormation. Contributed by @toby6578.
• ALB — the authenticate-oidc signing key is served — the PEM key that signs x-amzn-oidc-data is now served by kid on public-keys.auth.elb.<region>.amazonaws.com/<kid> and /_ministack/elb/public-keys/<kid>; an unknown kid answers 403 AccessDenied. Reported by @boesing.

Changed

• botocore 1.43.124 — the pinned botocore, whose models MiniStack reads for request and response shapes, moves from 1.43.106 to 1.43.124.

Fixed

• S3 and S3 Tables — Object Lock, multipart and metadata tokens — with PERSIST_STATE=1 and S3_PERSIST=1, retention and legal holds now survive a restart. CompleteMultipartUpload answers InvalidPartOrder, MalformedXML and InvalidPart for out-of-order, empty or ETag-less part lists. S3 Tables keeps one versionToken per table and answers ConflictException for a stale one.
• Cognito — refreshes, codes and invitations — GetTokensFromRefreshToken now requires a confidential client's secret and refuses an expired token ("Refresh Token has expired"). AdminCreateUser RESEND issues a new temporary password, sign-up and reset codes go where AWS sends them, and destinations mask as k***@e***. Contributed by @toby6578.
• ALB — authenticate-oidc refreshes the access token — the session kept an expired access token for its whole timeout. It now refreshes the token and user claims from the IdP, signs the user in again when it cannot, and passes AuthenticationRequestExtraParams. Reported by @boesing.
• ALB — the data plane finds load balancers in every account and region — a request by DNSName, <name>.alb.localhost or /_alb/<name>/ found only the default account's load balancers and fell through to S3. Every account and region is now searched, preferring the request's own. Contributed by @kharabasz.
• ALB — /_alb/<name>/ selects the load balancer whatever the Host — a Host naming another load balancer won and kept the /_alb/<name>/ prefix on the path. The path now selects the load balancer and Host only feeds its listener rules. Reported by @skialpine.
• EventBridge — PutEvents through a global endpoint — EndpointId was ignored. Endpoints now get an EndpointId and EndpointUrl, PutEvents delivers in the primary region with the endpoint ARN in resources and replicates to the secondary bus, and CreateEndpoint and UpdateEndpoint make AWS's checks. Reported by @kharabasz.
• Core — SigV4a requests run as the signing account with AUTH unset — a SigV4a (AWS4-ECDSA-P256-SHA256) request, such as PutEvents with EndpointId, ran as 000000000000. Its access key now names the account as a SigV4 one does. Contributed by @kharabasz.
• ACM — certificate Options — RequestCertificate dropped Options; they are now stored with AWS's defaults (ENABLED logging, DISABLED export). UpdateCertificateOptions keeps members not sent, and both operations answer AWS's SerializationException, ValidationException and InvalidStateException. Contributed by @kharabasz.
• EFS — file system policies and creation tokens — PutFileSystemPolicy added an Id and a random Sid; policies now come back in AWS's canonical form and malformed ones answer InvalidPolicyException. A reused CreationToken answers 409 FileSystemAlreadyExists. Contributed by @kharabasz.
• Auto Scaling — SpotInstancePools, filters and deletes — SpotInstancePools now defaults to 2 only for lowest-price and is refused with any other strategy; updates keep unsent MixedInstancesPolicy members. Describe calls apply their Filters and name lists, and deleting a group with instances needs ForceDelete. Contributed by @kharabasz.
• API Gateway — imported OpenAPI documents keep ANY methods and parameters — ImportRestApi, PutRestApi and an AWS::ApiGateway::RestApi Body skipped x-amazon-apigateway-any-method and an operation's parameters. They now become an ANY method and method.request.* parameters. Contributed by @mishukdutta-cz.
• Lambda — MiniStack's failures and handler errors as AWS reports them — MiniStack's own failures answered 200 with a "Mock response"; they now answer 500 ServiceException. Local handler and init errors carry the runtime's error document (Runtime.ImportModuleError, Runtime.HandlerNotFound, ...), with the exception's own type.
• Lambda — exiting runtimes and Docker networks — a runtime that exits answers Runtime.ExitError "Runtime exited with error: exit status N". A containerised MiniStack without DOCKER_NETWORK starts Lambda containers on its own network instead of the unreachable default bridge. Reported by @kharabasz.
• Lambda — the local Node shim has ListTagsCommand and Lambda.send() — Amplify Gen 2 deploys failed with ListTagsCommand is not a constructor under LAMBDA_EXECUTOR=local. Both now exist, matching @aws-sdk/client-lambda. Contributed by @bpmiranda3099.
• ECS and RDS — images from MiniStack's ECR and Aurora volumes — on the containerd image store, ECS tasks pinned to a digest failed "pull access denied for sha256"; they now run, and Lambda, AgentCore and CodeBuild images load from MiniStack's ECR too. With RDS_PERSIST=0, Aurora storage volumes are labelled and removed. Reported by @kharabasz.
• Docker-backed services — taken host ports are skipped — a containerised MiniStack saw ports other containers publish as free, so RDS, ElastiCache, OpenSearch, EKS, MWAA and DocumentDB containers failed "port is already allocated". Those ports are now skipped and a lost race retries the next port. Reported by @kharabasz.
• DSQL, DocumentDB and MWAA — tenants and volumes — DSQL clusters are kept per account and region, DocumentDB container names carry account and region so one tenant can't replace another's, and MWAA_PERSIST/DSQL_PERSIST volumes are labelled and removed with their resource.
• AppSync, API Gateway domains and CloudFormation signals — reached from any account — API-key GraphQL requests, AppSync Events, custom domains and wait-condition signals found only the default account's resources. They now run in the owner's account and region.
• Error codes and statuses are AWS's — SNS, ElastiCache, DocumentDB and CloudWatch used shape names as wire codes (SNS now InvalidParameter, ResourceNotFound). CloudTrail, Transfer, Backup and Bedrock errors are 400, OpenSearch ResourceNotFoundException is 409, and IoT and Firehose internal errors are 500.
• Requests keep what they send — about 40 services, among them ALB, Auto Scaling, EC2, ECS, RDS, ElastiCache, DynamoDB and Glue, dropped create and update parameters. They are now stored, returned and updatable, network and gateway load balancers get net/ and gwy/ ARNs, and updates keep or replace what AWS does (SSM PutParameter policies, RDS pending changes; Kinesis resharding closes parent shards).
• Responses carry AWS's members and pages — responses are trimmed to botocore's output shapes, without internal members or nulls. List and Describe calls honour page sizes and return the token, omitted on the last page. SES v2 GetEmailIdentity, SSM Policies, Cloud Map DiscoverInstances and Bedrock GetGuardrail match AWS.
• IAM, CloudControl and WAFv2 — attaching a policy that does not exist answers NoSuchEntity, CloudControl uses the type's primary identifier, and ListResourcesForWebACL filters by ResourceType, defaulting to APPLICATION_LOAD_BALANCER.
• Query and XML responses escape & and < — Auto Scaling, ALB and EC2 values such as a tag R&D made every later Describe for the account unparseable. They are now escaped.

Security

• Aurora DSQL — the backend Postgres is no longer on every interface — with DSQL_STRICT=1 each cluster's trust-auth Postgres was published on 0.0.0.0. It is now unpublished on MiniStack's network, or 127.0.0.1 only for a host-run MiniStack. Contributed by @toby6578.
• EventBridge — DescribeConnection no longer returns secrets — it returned the stored ApiKeyValue, OAuth ClientSecret and basic-auth Password, which AWS never returns.
• Containers follow MiniStack's binding — RDS, ElastiCache, OpenSearch, MWAA, EKS, DocumentDB and ECS task ports were published on every interface even with MiniStack bound to 127.0.0.1; they now follow it.