CloudWatch Logs live tail and Insights @ptr, Lambda recursion config, and DynamoDB/S3/EC2 fixes

August 6, 2026 · v1.4.12

v1.4.12 makes CloudWatch Logs Insights usable end-to-end — GetLogRecord, @ptr rows, and a real StartLiveTail stream — adds the Lambda recursion-config API, extends account+region isolation to API Gateway v2, and lands a batch of DynamoDB, S3, RDS, EC2, and Step Functions parity fixes.

New

• CloudWatch Logs — GetLogRecord, Insights @ptr rows, and StartLiveTail. StartQuery/GetQueryResults previously stubbed empty results, so there was no way to obtain an Insights @ptr or round-trip GetLogRecord. PutLogEvents now assigns an opaque pointer per event; Insights queries return matching rows in the AWS field/value shape (@ptr, @timestamp, @message, @logStream, @log) and GetLogRecord resolves them to the full field map. Insights evaluates a CWLI subset: fields, chained | filter (= and like /regex/ with AND semantics), | sort @timestamp, and a post-filter | limit. StartLiveTail holds a wire-valid application/vnd.amazon.eventstream open until the client disconnects (initial-response, then sessionStart, then sessionUpdate frames fed by matching concurrent PutLogEvents; one-second idle heartbeats; at most 10 updates buffered, oldest dropped with sampled set). FilterLogEvents now returns the eventId real AWS assigns. Contributed by @ovsteenb.
• Lambda — recursion config. The recursion-config sub-resource used by Terraform's aws_lambda_function_recursion_config was unrouted, so GET/PUT /2024-08-31/functions/{name}/recursion-config fell through to ResourceNotFoundException. Both operations are now served: RecursiveLoop defaults to Terminate, accepts Allow/Terminate, round-trips per function, and 404s an unknown function. Reported by @mayankgupta57.

Multi-region — API Gateway v2

• API Gateway v2. HTTP and WebSocket APIs, routes, integrations, stages, deployments, authorizers, responses, and tags were account-scoped, so control-plane resources and execute-api resolution bled across regions. They now scope by account and region, with execute-api dispatch pinning each request to its owning API's region. Contributed by @Areson.

Fixes

• S3 — lifecycle And filters no longer hang the Terraform waiter. A aws_s3_bucket_lifecycle_configuration rule using an And filter (prefix + tags) never converged, timing out the provider's 3-minute waiter: the AWS provider expands the And operator with ObjectSizeGreaterThan = 0 (and an empty Prefix when unset), which GetBucketLifecycleConfiguration omitted, so the provider's reflect.DeepEqual check never matched. The And operator now echoes both, and explicit object-size filters round-trip. Reported by @rogercost.
• DynamoDB — Scan/Query with ProjectionExpression and no Select. A scan or query supplying only ProjectionExpression was rejected with Select value ALL_ATTRIBUTES is not compatible with ProjectionExpression. Per the AWS API a ProjectionExpression without Select is equivalent to SPECIFIC_ATTRIBUTES; that is now the effective default whenever a projection is present, while an explicit incompatible Select (ALL_ATTRIBUTES, COUNT) with a projection is still rejected. Reported by @jin-gizmo.
• DynamoDB Streams — long-lived containers no longer accumulate backlog. Shard records grew without bound and event-source-mapping poll state was never released, so memory and read latency degraded over a container's lifetime. Stream records now expire after 24 hours and per-mapping poll state is released, with reads resuming from the trim horizon after expiry. Contributed by @maximoosemine.
• RDS — DB subnet group and security-group fidelity. Subnet groups now resolve their VpcId and availability zones from the referenced EC2 subnets and return InvalidSubnet for an unknown subnet, and VpcSecurityGroupIds on CreateDBCluster/ModifyDBCluster are preserved rather than mangled by the Query serializer. Contributed by @Areson.
• EC2 — DescribeVolumes, DescribeSubnets, and DescribeInternetGateways now evaluate Filters. All three ignored their filters and returned every resource. DescribeVolumes now matches on volume-id, size, status, volume-type, availability-zone, snapshot-id, encrypted, attachment.*, and tags; DescribeSubnets evaluates the cidr-block filter; and DescribeInternetGateways applies its filters. Contributed by @bandle.
• Step Functions — Map Parameters and EC2 aws-sdk parameter names. A Map state applied Parameters to the state input and then reused it as the per-item selector; Parameters is the legacy spelling of ItemSelector and is now applied only per item. Separately, acronym expansion needed for RDS was wrongly applied to EC2, mangling already-correct names like VpcId/EnableDnsHostnames; EC2 parameter names now pass through unchanged. Contributed by @bandle.
• Lambda — SDK stub lookup and durable restore scoping. JSON-RPC SDK client stubs are now keyed by exact full module specifier (including the events/logs aliases), preserving bundled-module precedence and the local-executor error for a missing stub (contributed by @roshie548). The durable-execution restore path rebuilt timers and callback indexes only for the ambient account, so executions in non-default accounts could stall and non-boot-region executions could re-arm under the wrong region after a restart; restore now rebuilds across every persisted account scope and derives each execution's account and region from its DurableExecutionArn (contributed by @Areson).

Upgrade

docker pull ministackorg/ministack:1.4.12
docker run -d -p 4566:4566 ministackorg/ministack:1.4.12

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.4.12
    ports:
      - "4566:4566"