v1.3.26 — S3 Files spec parity, OpenSearch VPC endpoint shape, CloudFormation CloudFront KeyValueStore

May 4, 2026 · v1.3.26

1.3.26 is a parity-and-fix release. Three changes, all spec-anchored against botocore's service-2.json for the affected services.

1. S3 Files — full s3files-2025-05-05 route and shape parity

Reported in the wild: aws s3files create-file-system failed against MiniStack with InvalidRequest: Unknown S3 Files route: PUT /file-systems. The CLI was right — AWS uses PUT, MiniStack was handling POST. That single bug exposed a deeper truth: the entire s3files module had been written against guessed shapes, not the published spec. So I rebuilt it end-to-end.

Verified against botocore/data/s3files/2025-05-05/service-2.json (now bundled in botocore 1.42.85+). All 21 operations, all input/output member names, all routes, all error shapes:

• CreateFileSystem is PUT /file-systems with required bucket + roleArn in the body (camelCase). Optional prefix, kmsKeyId, clientToken, tags, acceptBucketWarning round-tripped.
• Response shapes are camelCase (fileSystemId, fileSystemArn, creationTime as int epoch seconds, status as the lowercase enum available / creating / deleting / deleted / error / updating).
• CreateMountTarget / CreateAccessPoint are also PUT, not POST. Mount targets accept fileSystemId as either bare ID or full ARN; the resolver normalises both forms.
• ListAccessPoints requires fileSystemId per spec. Pagination on the three list ops uses maxResults + opaque base64 nextToken.
• Tagging moved from /tags/{arn} to the spec-correct /resource-tags/{resourceId} path: POST to tag, DELETE ?tagKeys=… to untag, GET to list. Resource ID accepts bare fs-… / fsap-… or full ARN.
• PutSynchronizationConfiguration enforces optimistic concurrency: passing a stale latestVersionNumber returns ConflictException 409.
• Errors are the AWS-standard codes — ValidationException, ResourceNotFoundException, ConflictException — with the right HTTP status and application/json content type (the rest-JSON protocol the service uses, not application/x-amz-json-1.0).

The reporter's exact CLI now works:

$ aws --endpoint-url=http://localhost:4566 s3files create-file-system \
    --bucket "arn:aws:s3:::seed-bucket" \
    --role-arn "arn:aws:iam::000000000000:role/s3files-role" \
    --query 'FileSystemId' --output text
fs-71848f5c630d4f20bb4d

2. OpenSearch — non-VPC domains stop emitting empty VPCOptions

Bug: CreateDomain / DescribeDomain were returning VPCOptions: {} alongside the public Endpoint. The Terraform AWS provider treats any non-null VPCOptions object as proof the domain is VPC-backed and then fails the read with:

OpenSearch Domain in VPC expected to have null Endpoint value

1.3.26 brings the response shape in line with the AWS spec:

• Non-VPC domains omit VPCOptions entirely from DomainStatus and DomainConfig.
• VPC-shaped domains return Endpoints["vpc"] (a map) instead of the singular Endpoint, matching the VPCDerivedInfo shape: VPCId, SubnetIds, AvailabilityZones, SecurityGroupIds.
• UpdateDomainConfig with VPCOptions swaps the endpoint shape in place: Endpoint disappears, Endpoints["vpc"] appears, the underlying URL is preserved.

Contributed by @marcin-nowak-scl.

3. CloudFormation — AWS::CloudFront::KeyValueStore provisioning

1.3.25 shipped the native CloudFront KeyValueStore management + data plane. 1.3.26 makes it provisionable from CloudFormation, CDK, and Terraform (via the CFN provider).

• Create / Update / Delete handlers registered for AWS::CloudFront::KeyValueStore.
• Comment is the only mutable property per the AWS spec — UpdateStack with a Comment change updates in place, no replacement.
• Fn::GetAtt exposes Arn, Id, Status.
• Native CreateKeyValueStore now also accepts the optional ImportSource input (requires both SourceType and SourceARN; missing fields return InvalidArgument). Stored on the record so describes can see what was requested. Data import itself is a no-op — same stance MiniStack takes for other side-effect creates.

To enable in-place updates for KeyValueStore (and future resources that need them), the CloudFormation engine now routes previously-provisioned resources through a per-type update handler when one is registered. Resources that don't define an update handler fall back to the existing idempotent create path — no change for the rest of the catalogue.

Resources:
  EdgeRoutes:
    Type: AWS::CloudFront::KeyValueStore
    Properties:
      Name: routing-config
      Comment: edge routing table

Upgrade

docker pull ministackorg/ministack:1.3.26
docker run -d -p 4566:4566 ministackorg/ministack:1.3.26

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.3.26
    ports:
      - "4566:4566"