Lambda Function URL data plane, API Gateway v1 region isolation, and Step Functions EC2 output shapes

August 4, 2026 · v1.4.11

v1.4.11 serves the Lambda Function URL data plane, extends account+region isolation to API Gateway v1 and CloudWatch Logs Insights queries, and reshapes Step Functions aws-sdk:ec2 task output to the SDK shape. It also completes the CloudWatch CBOR fix that unblocks the Terraform AWS provider.

New

• Lambda — Function URL data plane. CreateFunctionUrlConfig returned a {urlId}.lambda-url.{region}.on.aws URL that nothing served — a request to it matched no route, fell through to S3 virtual-host addressing, and came back as NoSuchBucket. Function URLs are now invocable, host-based or via a path-based /_aws/lambda-url/{urlId}/… form. Requests arrive as a payload-format-2.0 event ($default route and stage, percent-encoded rawQueryString, body/queryStringParameters omitted rather than null); AuthType is enforced (AWS_IAM returns 403 to an unsigned request, NONE is open); the Cors config drives preflight and response headers; and InvokeMode: RESPONSE_STREAM replies are unwrapped from the HttpResponseStream framing. Contributed by @liammizrahi.

Multi-region — API Gateway v1 and CloudWatch Logs

• API Gateway v1. REST APIs, resources, methods, integrations, deployments, stages, models, API keys, and usage plans were stored globally and leaked across account and region boundaries. They now scope by account and region; execute-api dispatch resolves a REST API's owning region by id (the mock execute-api host carries no region segment) and runs the invocation in that scope, and a caller-supplied ms-custom-id stays unique across the account's regions. Persisted state carries the versioned regional schema (on-disk format v3) that an older binary refuses; legacy snapshots restore into each API's region. Contributed by @Areson.
• CloudWatch Logs — Insights queries. Logs Insights query ids were account-scoped, so a StartQuery in one region could be read or stopped from another, contrary to the regional Logs Insights API. They now scope by account and region; persisted state carries the on-disk format v3 an older binary refuses, and legacy queries restore into their referenced log group's region. Contributed by @Areson.

Fixes

• Step Functions — aws-sdk:ec2 tasks now return the SDK output shape. The EC2 Query-XML adapter passed a near-wire structure through without reshaping or typing, so describeVolumes returned VolumeSet.Item.Status where AWS returns Volumes[0].State, scalars were strings, empty collections were "" instead of [], and a requestId the SDK never returns was included — an ASL Choice written against AWS silently took the wrong branch locally. The normalizer now follows the SDK output shape: PascalCase member names, *Set wrappers pluralized and unwrapped, and list/int/bool leaves coerced, with overrides for names that cannot be inferred (e.g. keySet → KeyPairs). Contributed by @bandle.
• CloudWatch — DescribeAlarms and metric reads over CBOR still broke the Terraform AWS provider ≥ 6.50. After 1.4.10 fixed the alarm timestamp encoding, absent optional fields (ExtendedStatistic, Unit) were still serialized as CBOR Nil, which the provider's typed smithy-rpc-v2-cbor decoder rejected with unexpected value type *cbor.Nil; separately, GetMetricStatistics and GetMetricData returned their Timestamp / Timestamps members as strings rather than CBOR tag 1. Absent optional fields are now omitted from every CloudWatch CBOR response (real AWS never sends null), and metric-data timestamps are tag-1 encoded. Reported by @sdreger.

Upgrade

docker pull ministackorg/ministack:1.4.11
docker run -d -p 4566:4566 ministackorg/ministack:1.4.11

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.4.11
    ports:
      - "4566:4566"