S3 Tables, Glue PySpark image, IAM access-key ops, Lambda log + EC2 tag fixes

May 26, 2026 · v1.3.50

One new service, an analytics upgrade for Glue, two new IAM operations from a first-time contributor, and a pair of AWS-shape fixes on Lambda and EC2.

S3 Tables (s3tables)

New service emulator for the AWS S3 Tables API: table buckets, namespaces, and Iceberg-format tables. Control plane covers CreateTableBucket, ListTableBuckets, GetTableBucket, DeleteTableBucket, CreateNamespace, ListNamespaces, GetNamespace, DeleteNamespace, CreateTable, ListTables, GetTable, DeleteTable, GetTableMetadataLocation, UpdateTableMetadataLocation.

Ships with an embedded Iceberg REST catalog at /iceberg so Spark jobs configured with spark.sql.catalog.*.type=rest and spark.sql.catalog.*.uri=http://<ministack>/iceberg can create, load, and commit Iceberg tables without an external catalog server. Data files land in MiniStack's S3 service; table metadata (schemas, snapshots, manifests) lives in memory.

import boto3
tables = boto3.client("s3tables", endpoint_url="http://localhost:4566")

bucket = tables.create_table_bucket(name="analytics")
arn = bucket["arn"]

tables.create_namespace(tableBucketARN=arn, namespace=["sales"])
tables.create_table(
    tableBucketARN=arn, namespace="sales", name="orders", format="ICEBERG",
    metadata={"iceberg": {"schema": {"fields": [
        {"name": "id",     "type": "long",   "required": True},
        {"name": "amount", "type": "double"},
    ]}}},
)

Glue Spark jobs run on the official amazon/aws-glue-libs PySpark image

GlueVersion: 4.0 and 3.0 map to their canonical AWS Glue images (glue_libs_4.0.0_image_01 / glue_libs_3.0.0_image_01); override the image via GLUE_DOCKER_IMAGE. Job containers run on MiniStack's Docker network so they reach S3, RDS, and other ministack services by container hostname.

IAM UpdateAccessKey and GetAccessKeyLastUsed

UpdateAccessKey toggles an access key between Active and Inactive, matching the two statuses the real AWS API accepts; optional UserName is validated when provided. GetAccessKeyLastUsed returns the AWS "never used" shape (Region / ServiceName = N/A, no LastUsedDate) since MiniStack does not track per-key usage history. Contributed by @lahmish.

Lambda invocation log now includes user output alongside the traceback on error

When a handler raised after printing, the response log dropped the user output and only returned the traceback. Both are now returned, newline-separated, matching real Lambda CloudWatch Logs output — so anyone using LogType=Tail to debug a crashing Lambda sees their print output up to the failure plus the exception, not just the exception. Contributed by @Baptiste-Garcin.

EC2 CreateVpcEndpoint and CreateFlowLogs persist TagSpecifications

Tags passed at creation time were silently dropped. Tags are now stored, returned by DescribeFlowLogs, and cleaned up on DeleteFlowLogs. The fl- prefix is also registered in the resource-type guesser so flow-log IDs are correctly resolved by the Resource Groups Tagging API. Contributed by @lahmish.

Upgrade

docker pull ministackorg/ministack:1.3.50
docker run -d -p 4566:4566 ministackorg/ministack:1.3.50

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.3.50
    ports:
      - "4566:4566"