CloudFront policies, Cognito and CloudFormation region isolation, and DynamoDB PartiQL RETURNING

August 3, 2026 · v1.4.10

v1.4.10 adds CloudFront cache, origin request, and response headers policies, extends account+region isolation to Cognito and CloudFormation, and grows DynamoDB PartiQL with RETURNING and REMOVE. It also lands API Gateway, EC2, IoT, ACM, and a CloudWatch CBOR fix that unblocks the Terraform AWS provider.

New

• CloudFront — cache, origin request, and response headers policies. Full CRUD plus GetConfig and ListDistributionsBy…Id for CachePolicy, OriginRequestPolicy, and ResponseHeadersPolicy, so Terraform's aws_cloudfront_cache_policy, aws_cloudfront_origin_request_policy, and aws_cloudfront_response_headers_policy create, read, update, and delete end-to-end. Each config round-trips in full (TTLs and cache-key parameters, header/cookie/query-string behaviors, CORS, security headers, server-timing, custom and remove headers), with ETag on every read, If-Match enforced on update/delete, and the …AlreadyExists / NoSuch… / …InUse error codes matching AWS. Reported by @wparad.
• EKS — ListIdentityProviderConfigs. GET /clusters/{name}/identity-provider-configs was unimplemented and returned No route. It now returns the AWS-shaped identityProviderConfigs list ({name, type}) and a ResourceNotFoundException for an unknown cluster. Contributed by @b-rajesh.
• DynamoDB PartiQL — RETURNING, REMOVE, and richer WHERE predicates. ExecuteStatement now supports RETURNING ALL OLD * / ALL NEW * / MODIFIED OLD * / MODIFIED NEW * on UPDATE and RETURNING ALL OLD * on DELETE, the REMOVE clause, and begins_with / IN / IS MISSING / IS NOT MISSING predicates. An UPDATE whose WHERE matches no item now returns ConditionalCheckFailedException rather than a silent no-op, matching AWS.

Multi-region — Cognito and CloudFormation

• Cognito. User pools, pool domains, identity pools, and identity tags were account-scoped and leaked across regions. They now scope by account and region, and unsigned IDP / Identity data-plane requests infer the owning region from pool and identity IDs, tokens, sessions, or unambiguous client ownership. Persisted state carries the versioned regional schema (on-disk format v3) that an older binary refuses; legacy resources self-place from their region-bearing IDs. Contributed by @Areson.
• CloudFormation. Stacks, stack events, exports, and change sets were account-scoped, so same-name stacks collided across regions and exports leaked into cross-region Fn::ImportValue lookups. They now scope by account and region; asynchronous stack work retains the owning region and nested stacks stay co-located with their parent. Contributed by @Areson.

Fixes

• CloudWatch — DescribeAlarms over CBOR broke the Terraform AWS provider ≥ 6.50. Alarm StateUpdatedTimestamp / AlarmConfigurationUpdatedTimestamp were serialized as bare unsigned integers in the smithy-rpc-v2-cbor response, so the provider's typed decoder failed the read-back with unexpected value type cbor.Uint and aws_cloudwatch_metric_alarm could not be created. Timestamp members are now encoded as CBOR tag 1 (epoch date-time), which the decoder expects. Reported by @sdreger.
• API Gateway — HTTP API routes are selected by specificity, not creation order. The v2 router returned the first route whose method and path matched in insertion order, so a dedicated route (e.g. POST /items) could lose to a greedy ANY /{proxy+} catch-all depending on which was created first. Matching routes are now ranked so the most specific one wins, as real API Gateway always dispatches to the most specific match. Contributed by @Lukasdoe.
• EC2 — DescribeAvailabilityZones now returns real AZ IDs. Every zone reported its ZoneId as a copy of its ZoneName (e.g. us-east-1a under both), but AWS deliberately differs: names are shuffled per account while IDs are region-coded and stable. ZoneId is now the region-coded form (use1-az1, euc1-az1, apse2-az1, …), matching AWS's coding across every region. Contributed by @bandle.
• ACM — wildcard SAN DNS validation record now matches its base domain. A certificate with a wildcard SAN emitted a validation record named _acme-challenge.*.example.com, so Terraform's aws_acm_certificate_validation never found the record its aws_route53_record had created. Real ACM strips the leading *., so *.example.com and example.com share one _acme-challenge.example.com CNAME; RequestCertificate now emits that collapsed record and the validation resolves. Reported by @wparad.
• IoT — binary topic-rule payloads are no longer corrupted. Rule events decoded the payload as UTF-8 with errors="replace", so a non-UTF-8 payload reached the action with every non-ASCII byte replaced by U+FFFD. encode(<expr>, 'base64') is now supported and encodes the payload as published, so a rule can deliver the exact bytes; no lossy decode remains on the publish → rule → invoke path. Contributed by @maximoosemine.
• IoT — topic-rule SELECT is now evaluated. The rules engine ignored a rule's SELECT clause and delivered the whole message. It now parses and projects *, attribute paths, AS aliases, topic() / topic(n), timestamp(), and literals, for both Basic Ingest and topic-filter delivery. Contributed by @maximoosemine.
• DynamoDB — ProjectionExpression list-index results no longer carry null placeholders. Projecting a list element (e.g. #i[2]) returned the element behind sparse null entries instead of the single projected element. Projected list results are now compacted to only the referenced elements.
• Persistence — MediaConnect state now persists, and regionalized services carry downgrade protection. MediaConnect had restore logic but was never registered for saves, so its state was lost across restarts; it now persists. Kinesis, Firehose, KMS, EventBridge, ElastiCache, Pipes, Scheduler, SNS, and MediaConnect now advertise the on-disk format version an older binary refuses rather than misreading their region-scoped state. Contributed by @Areson.

Upgrade

docker pull ministackorg/ministack:1.4.10
docker run -d -p 4566:4566 ministackorg/ministack:1.4.10

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.4.10
    ports:
      - "4566:4566"