ministackorg/ministack v1.5.39

on GitHub

What's Changed

[1.5.39] — 2026-11-08

Added

• Secrets Manager — RemoveRegionsFromReplication and StopReplicationToReplica — both answered Unknown action, so terraform destroy of a secret with a replica block failed. The first deletes the listed regions' replicas and returns the remaining ReplicationStatus; the second, called in a replica's region, makes it a standalone secret. Contributed by @kharabasz.
• Cognito — attribute verification — adds GetUserAttributeVerificationCode and VerifyUserAttribute. A changed email or phone number now becomes unverified and gets a code where the pool auto-verifies it, and AttributesRequireVerificationBeforeUpdate keeps the old value until the new one is verified. Contributed by @toby6578.
• Cognito — hosted UI forgot password and MFA — the hosted sign-in pages now have a forgot-password flow, ask for a TOTP or SMS code after the password, and enrol TOTP where the pool requires MFA. Messages match AWS's classic hosted UI; the pages render straight from POST /login, and reset codes are checked only with AUTH=true. Contributed by @toby6578.
• Cognito — RFC 8707 resource indicators on managed login — on a ManagedLoginVersion 2 domain, a resource naming one of the pool's resource servers now becomes the access token's aud, and refreshes keep it. An unregistered one fails the code exchange with invalid_grant. Contributed by @toby6578.
• Cognito — the PostAuthentication trigger — LambdaConfig.PostAuthentication was stored and never invoked. It now runs after a password, MFA or challenge sign-in through the API, before tokens are issued and before NEW_PASSWORD_REQUIRED, but not on refresh. A failing Lambda fails the sign-in with UserLambdaValidationException, InvalidLambdaResponseException or UnexpectedLambdaException. Reported by @ryuzo-hayashi.
• CloudFront — cf.kvs() in CloudFront Functions — import cf from 'cloudfront' failed in cloudfront-js-2.0. get() (string, json or bytes), exists() and meta() now read the function's associated KeyValueStore; a missing key throws KeyNotFound, and cf.kvs() in a function without a store throws InternalError. Reported by @mkusaka.
• KMS — the aws/s3 AWS managed key — an S3 write with aws:kms and no key ID (or alias/aws/s3) was refused. S3 now creates the account's aws/s3 key on first use (KeyManager AWS, AWS's description and key policy, alias alias/aws/s3) and encrypts with it, as does a bucket default of aws:kms without KMSMasterKeyID. Contributed by @kharabasz.
• S3 — PutObject through another account's access point — it was refused. It now succeeds when the caller's identity policy, the access point policy and the owner's bucket policy all allow it, and lands in the owner's bucket under its default encryption; a missing grant answers AWS's AccessDenied for that step. Contributed by @kharabasz.

Changed

• Secrets Manager — a request body that is not one JSON object — an empty or blank body was read as {}, and [], null or a bare string crashed with a 500. Every action now answers SerializationException for a body that is not a single JSON object (a list names itself, the rest carry no message); whitespace around the object is fine. Contributed by @kharabasz.
• Secrets Manager — DeleteSecret on a primary that still has replicas — it deleted the replicas with the primary. It now answers InvalidParameterException ("You can't delete secret … that still has replica regions [...]"), so replicas are removed first; called in a replica's region it answers "Operation not permitted on a replica secret". Contributed by @kharabasz.

Fixed

• RDS — Aurora member reboots no longer stick — after ModifyDBCluster rotated the master password, a rebooted member stayed rebooting or went failed; its readiness check now uses the cluster's password. Deleting an instance no longer recomputes every cluster's status, which left a cluster with a member mid-reboot in creating. Contributed by @jayjanssen.
• Auto Scaling — InstanceRequirements launch templates and overrides are checked — a plain LaunchTemplate with InstanceRequirements now answers InvalidQueryParameter, and bad overrides (neither or both of InstanceType and InstanceRequirements, mixed kinds, partial weights, duplicates, more than 40) answer ValidationError with AWS's messages. Contributed by @kharabasz.
• S3 — SSE-KMS keys are resolved through KMS — a write stored the key reference as given and accepted keys that do not exist. It now stores and echoes the key ARN and refuses an unknown key with KMS.NotFoundException before any authorization, as on AWS; a write naming a key MiniStack's KMS does not hold now fails, so create the key first. Contributed by @kharabasz.
• S3 — bucket policies on s3:x-amz-server-side-encryption-aws-kms-key-id — with AUTH=true the key was never set, so a policy denying uploads under any other KMS key also denied the right one. Writes now carry the key ARN however the key is named, or the bucket default's, and multipart parts carry their upload's key. Contributed by @kharabasz.
• Auto Scaling — DesiredCapacityType is reported as AWS reports it — since 1.5.38 every group reported units, so Terraform planned a change on every run. Only a group with a MixedInstancesPolicy now has one, vcpu and memory-mib need InstanceRequirements, and state saved by 1.5.38 is cleaned on restore. Contributed by @kharabasz.
• CloudFront — Compress: true compresses responses — origin responses passed through uncompressed. They are now gzipped, or Brotli-encoded when the optional brotli package is installed, under AWS's conditions (status, size, Content-Type, no Content-Encoding); a strong ETag becomes weak, and the origin gets the normalized Accept-Encoding (br,gzip, gzip, br or identity). Reported by @skialpine.
• Cognito — MFA through the API — a user whose pool requires MFA and who has no factor signed in without one. They now get MFA_SETUP and, once enrolled, a SOFTWARE_TOKEN_MFA challenge; a TOTP enrolled on the hosted pages is challenged by the API too, and five wrong codes lock the user out for a growing time, at most 15 minutes.
• IAM — request condition keys with AUTH=true — keys such as s3:signatureversion, s3:x-amz-storage-class, kms:EncryptionContext:*, secretsmanager:VersionStage, ssm:Overwrite, sns:Protocol, ec2:Region and iam:PermissionsBoundary were never set, so a policy conditioned on them denied valid requests. They are now set from the request.
• S3 — ListMultiRegionAccessPoints pages — the token was a position, so a create or delete between pages skipped or repeated an access point; it now names the last one returned.