Amazon Inspector2, RDS auto-respawn at boot, Glue views, CloudFront summary parity

May 25, 2026 · v1.3.49

One new service, three contributor improvements, and a handful of persistence + AWS-shape fixes that tighten parity across RDS, AppSync Events, Glue, and CloudFront.

Amazon Inspector2

New service emulator covering 14 operations: Enable, Disable, ListFindings (with filtering, sorting, pagination), BatchGetFindingDetails, ListCoverage, ListCoverageStatistics, ListFindingAggregations, SearchVulnerabilities, TagResource, UntagResource, ListTagsForResource, CreateFilter, ListFilters, DeleteFilter. Generates deterministic stub vulnerability findings for ECR container images, Lambda functions, and EC2 instances when scanning is enabled — enough surface to unblock CI for vulnerability-management code paths that previously had no way to test against a local emulator. Contributed by @ry-allan.

RDS auto-respawns at boot with PERSIST_STATE=1

When an rds.json state file is present, MiniStack now eager-imports the RDS module at startup and respawns the Docker container for every persisted instance immediately — no client API call required. Previously the module loaded lazily on the first RDS request, so the postgres / mysql container stayed down until the user happened to call an awslocal rds operation; the natural expectation is that docker compose up brings the database back the same way it brings ministack back. Zero idle cost when no RDS state file is present (the conditional skips the import entirely). Reported by @doodaz.

Glue persists view-related fields on CreateTable / UpdateTable

Views created via CreateTable — the path used by Trino, Spark, and Athena — were losing their SQL body. _create_table now persists ViewOriginalText and ViewExpandedText (contributed by @yonatoasis), so GetTable returns the view body and Trino's iceberg connector stops failing with viewOriginalText must be present. Newer multi-dialect view clients (Spark 3.4+, Glue 4.0 jobs, Lake Formation cross-engine views) also get ViewDefinition (the structured form) and IsMultiDialectView round-tripped instead of dropped.

AppSync Events resources persist across restarts

With PERSIST_STATE=1, Event APIs, channel namespaces, and API keys created against the AppSync Events endpoint (/v2/apis) were silently dropped on container restart. The state file was never written at shutdown because the events module is reached only via a cross-service call from the parent AppSync handler. State is now saved and restored on every restart, matching the behavior of every other persisted service. The same fix covers a related class of restart drops for apigateway_v1 on first boot, Lambda-auto-created CloudWatch log groups, and EventBridge targets fired by S3 notifications. Reported by @yaegassy.

RDS respawn no longer fails with port is already allocated

Restored DB instances tried to bind the engine's standard port (5432 for postgres, 3306 for mysql) on the host instead of the original docker host port — so every restart with persisted state left the instance in failed. The host port is now tracked separately on the instance, validated as free before reuse, and falls back to a fresh free port if something else has taken it. Stale Created-status containers from prior failed boots are force-removed before respawn so they don't hold the binding. Reported by @doodaz.

CloudFront DistributionSummary parity

Two shape fixes. ListDistributions now round-trips the stored origin configuration (Origins, DefaultCacheBehavior) so custom origins survive create → get → list → update (contributed by @CoffeeRaptor). And the remaining required fields of the real AWS shape — Aliases, CacheBehaviors, CustomErrorResponses, PriceClass, ViewerCertificate, Restrictions, WebACLId, HttpVersion, IsIPV6Enabled, Staging — are now emitted alongside them. When a field wasn't set on the original CreateDistributionConfig, MiniStack emits a minimal-but-valid default (empty Quantity=0 containers, CloudFrontDefaultCertificate=true, HttpVersion=http2) so strict-parsing SDKs like the AWS Go v2 SDK and Java v2 don't reject the response.

Upgrade

docker pull ministackorg/ministack:1.3.49
docker run -d -p 4566:4566 ministackorg/ministack:1.3.49

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.3.49
    ports:
      - "4566:4566"