Glue Iceberg REST Catalog, ColumnStatistics, and a batch of CloudFormation, Step Functions, and Lambda fixes

June 11, 2026 · v1.3.62

v1.3.62 lands two Glue additions for the lakehouse and analytics path — a Glue-backed Apache Iceberg REST Catalog and the ColumnStatistics API family — alongside five fixes spanning CloudFormation, Step Functions, and Lambda.

Glue — Iceberg REST Catalog (Glue-backed)

A read-path subset of the Apache Iceberg REST OpenAPI served at /iceberg, mirroring AWS Glue's glue.<region>.amazonaws.com/iceberg endpoint (prefix shape catalogs/{catalog}) on the glue credential scope — distinct from the S3 Tables Iceberg surface, exactly as on real AWS. GET /v1/config, ListNamespaces, GetNamespace, ListTables, LoadTable, and HEAD TableExists are served; writes return 501. A Glue table participates when its Parameters["metadata_location"] points at an Iceberg metadata.json on MiniStack S3 (written by an external engine such as Trino or Spark; passed through verbatim). This lets DuckDB's iceberg extension ATTACH against MiniStack (requires USE_SSL=1). Contributed by @yonatoasis.

Glue — ColumnStatistics API family (table + partition)

UpdateColumnStatisticsForTable / GetColumnStatisticsForTable / DeleteColumnStatisticsForTable and the *ForPartition equivalents, with AWS's {ColumnStatisticsList, Errors} / {Errors} response shapes and per-column EntityNotFoundException error entries. Statistics are account-scoped, persisted, and cleared when the owning table or partition is deleted. Contributed by @yonatoasis.

Fixes

• CloudFormation — DescribeStackEvents returns the initial REVIEW_IN_PROGRESS event for change-set-created stacks. CreateChangeSet with --change-set-type CREATE left the placeholder stack in REVIEW_IN_PROGRESS but seeded an empty event list, so DescribeStackEvents returned [] and tools reading StackEvents[0] (notably sam deploy) crashed with IndexError. The placeholder stack now emits the REVIEW_IN_PROGRESS event for the AWS::CloudFormation::Stack resource on creation. Contributed by @maximoosemine.
• Step Functions — ecs:runTask / ecs:runTask.sync no longer drop ContainerOverrides. The Pascal→camelCase conversion at the SFN→ECS hand-off only covered top-level Parameters keys, so nested Overrides.ContainerOverrides (including resolved "Value.$" entries) and NetworkConfiguration stayed PascalCase and were silently ignored — the container ran with task-definition environment only while the .sync state still succeeded. The conversion is now recursive. Contributed by @lucasmfraser.
• Lambda — layers are reachable in the docker executor, and zip permissions are preserved. The docker RIE executor extracted each layer to /opt/layer_N, which is not on the runtime's search path, so import from a layer failed; layer contents now merge into /opt (so /opt/python, /opt/lib, /opt/bin resolve), exactly as on real AWS. Layer and function zip extraction now also restores unix mode bits, so /opt/bin tools and bundled binaries keep their +x. Reported by @omargr299.
• awslocal works in TLS mode without --no-verify-ssl. The wrapper now resolves MiniStack's TLS certificate (the auto-generated ${TMPDIR}/ministack-tls/server.crt, or a MINISTACK_SSL_CERT / MINISTACK_CA_BUNDLE override) and exports AWS_CA_BUNDLE only when it points at a real file, so the AWS CLI verifies the cert instead of failing — plain-HTTP usage is untouched. Reported by @ChronosMasterOfAllTime.
• Lambda — restored SQS event source mappings resume polling after a warm restart. The ESM poller is started from lambda_svc's import-time restore, but the module was imported lazily only on a Lambda request, so after a persisted restart a pure-SQS workload (just sending to a mapped queue) never started the poller and the restored mapping sat Enabled but unpolled while messages piled up. lambda_svc is now eager-imported at boot when persisted ESMs exist, so polling resumes exactly like a fresh CreateEventSourceMapping. Reported by @ChronosMasterOfAllTime.

Upgrade

docker pull ministackorg/ministack:1.3.62
docker run -d -p 4566:4566 ministackorg/ministack:1.3.62

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.3.62
    ports:
      - "4566:4566"