v1.3.15 — AWS Backup, real SFTP server, Step Functions versioning, EventBridge replay

April 26, 2026 · v1.3.15

1.3.15 is a feature-heavy release. AWS Backup arrives as a 21-op control plane, Transfer Family gets a real SFTP listener (not a stub), Step Functions picks up the alias and versioning APIs that Terraform v6 expects on every refresh, EventBridge finally dispatches the archive events it stores, and CloudFormation gains the missing ApiGatewayV2 provisioners that block CDK HTTP API deployments.

1. AWS Backup — full control plane

21 operations across vaults, plans, selections, jobs, and tagging. Multi-tenant via AccountScopedDict, persisted, and integrated with the Resource Groups Tagging API. Jobs return COMPLETED immediately — sufficient for Terraform aws_backup_* IaC validation; no real backup is performed.

aws --endpoint-url=http://localhost:4566 backup create-backup-vault \
    --backup-vault-name my-vault

aws --endpoint-url=http://localhost:4566 backup create-backup-plan \
    --backup-plan file://plan.json

Contributed by @AdigaAkhil.

2. Transfer Family — real SFTP server

An asyncssh-backed listener on :2222 (override with SFTP_PORT), backed by MiniStack's S3 state. Public-key auth resolves the user, server, and account in one shot — no username$serverid decoration. Real SFTP clients connect and perform real reads/writes against S3.

• Per-server ports — SFTP_PORT_PER_SERVER=1 allocates one port per server from SFTP_BASE_PORT (default 2300).
• Home directory mapping — both HomeDirectoryType=PATH and LOGICAL are honoured.
• Host key persists when PERSIST_STATE=1, so repeated test runs don't trigger known_hosts churn.
• StartServer / StopServer work like AWS — OFFLINE servers refuse auth.

asyncssh lives under the [full] extra; the base install serves the control plane and skips the listener.

3. Step Functions — alias and versioning APIs

Two APIs that Terraform AWS provider v6 calls unconditionally on every refresh, and which previously failed with InvalidAction:

• Aliases — CreateStateMachineAlias, UpdateStateMachineAlias, DeleteStateMachineAlias, DescribeStateMachineAlias, ListStateMachineAliases, plus alias-ARN resolution on DescribeStateMachine. Validation matches AWS — name regex, weights summing to 100, referenced versions must exist. DeleteStateMachineVersion now refuses to drop a version that an alias still routes to.
• Versioning — PublishStateMachineVersion, DeleteStateMachineVersion, ListStateMachineVersions, plus qualified-ARN resolution on DescribeStateMachine. CreateStateMachine accepts publish=True. Optimistic concurrency via revisionId; version numbers are monotonic and never reused after delete.

Both contributed by @mattwang44.

4. EventBridge archives — events are stored AND dispatched

Until now, archives stored events on PutEvents (incrementing EventCount) but StartReplay didn't actually re-dispatch them. 1.3.15 closes the loop: StartReplay re-dispatches the snapshot to the destination bus in a background thread, so the destination's current rules and targets fire just like a fresh PutEvents. Archives persist; replays surviving a restart are flipped to FAILED (the worker thread is gone, the replay can't safely resume).

Contributed by @AdigaAkhil.

5. CloudFormation — ApiGatewayV2 Integration + Route provisioners

The two missing pieces that block full CDK HTTP API deployments (HttpApi.addRoutes()) against MiniStack. Both support Fn::GetAtt (IntegrationId, RouteId) and idempotent delete. Contributed by @hiddengearz.

6. CloudWatch Logs Delivery API

The 2023-era replacement for subscription filters that vended-logs producers like Bedrock and AppSync use to ship logs to S3 / CWL / Firehose. 12 actions across DeliverySource / DeliveryDestination / Delivery:

• Server-derived service and deliveryDestinationType.
• outputFormat validated against the AWS enum.
• One-Delivery-per-pair enforced with ConflictException.

Contributed by @mattwang44.

Also in this release

• Fixed: RDS Postgres 18+ container refused to start — postgres:18+ images moved to a major-version-specific data layout. Mount path is now chosen per major: /var/lib/postgresql/data for < 18 (unchanged), /var/lib/postgresql for ≥ 18. MySQL / MariaDB / Aurora MySQL unaffected. Adds postgres 18.3, 17.5, and 16.4 to DescribeDBEngineVersions. Reported and contributed by @whittin3.
• Changed: RDS containers mount only the engine-appropriate data path. Previously both /var/lib/postgresql/data and /var/lib/mysql were mounted on every container regardless of engine — harmless but wasteful and opaque when debugging.

Upgrade

docker pull ministackorg/ministack:1.3.15
# or
docker pull ministackorg/ministack:latest

Full changelog: CHANGELOG.md.