August 7, 2026 · v1.4.14
v1.4.14 adds three services and a real build runner. EventBridge Pipes gains its SDK control plane, AWS Config and Cloud Control API arrive, and CodeBuild can now execute builds through the official AWS local agent. Cognito grows choice-based Hosted UI sign-in, and a batch of RDS, CloudWatch, SNS, CloudFormation, and CloudWatch Logs parity fixes land on top.
aws pipes list-pipes fell through to S3 addressing and returned NoSuchBucket. ListPipes, CreatePipe, DescribePipe, UpdatePipe, DeletePipe, StartPipe, StopPipe, and the tag operations are now served over boto3 / Terraform / CDK at pipes.<region> and /v1/pipes.PutConfigRule / DescribeConfigRules / DeleteConfigRule, recorder and delivery-channel CRUD plus their status reads, StartConfigurationRecorder / StopConfigurationRecorder, and the compliance and evaluation-status reads.awscc provider and CDK L1 constructs: CreateResource / GetResource / UpdateResource / DeleteResource / ListResources plus the resource-request status and cancel operations, with the AWS ProgressEvent and ResourceDescription shapes (Properties as a JSON string).MINISTACK_CODEBUILD_EXECUTE=1). StartBuild used to return a build that had already SUCCEEDED, so a pipeline rehearsed against MiniStack passed without a single phase running. With the flag set, StartBuild returns IN_PROGRESS and the project's inline buildspec is handed to the official AWS CodeBuild local agent, which runs the phases in the project's environment.image; BatchGetBuilds reflects live phases and the container's exit status maps to SUCCEEDED / FAILED. Default behavior is unchanged. Contributed by @igorgawrys1.ALLOW_USER_AUTH). A client whose ExplicitAuthFlows includes ALLOW_USER_AUTH now drives a multi-step flow from Policies.SignInPolicy.AllowedFirstAuthFactors: username, a challenge-selection screen (skipped when one factor is allowed), then PASSWORD or EMAIL_OTP. Clients without the flow keep the single-page form. Contributed by @kjdev.UpdateKeyDescription. The action was unregistered, so every call returned InvalidAction and terraform-provider-aws failed the whole update when an aws_kms_key description drifted. It now updates the description (an empty string clears it, as on AWS) and 404s an unknown key. Contributed by @sac-outsystems.StopDBCluster / StartDBCluster now stop and start Aurora compute. Both operations only flipped metadata, so a "stopped" cluster's container kept answering SQL. StopDBCluster now stops the shared container (preserving the volume and data) and StartDBCluster restarts it, returning immediately while a readiness worker flips members to available; invalid transitions return the AWS-exact InvalidDBClusterStateFault messages. Contributed by @kiran01bm.16.99 silently ran PostgreSQL 16 while claiming to be 16.99. Unknown versions now fail with InvalidParameterCombination / Cannot find version {version} for aurora-postgresql (bare majors like 16 still resolve, as on AWS), and the advertised catalog is refreshed to the real creatable set. Contributed by @kiran01bm.CreateDBInstance returned wire code DBInstanceAlreadyExistsFault, but real AWS drops the Fault suffix for instance-level codes, so aws-sdk-go-v2 deserialized a generic error instead of the typed one. The wire code is now DBInstanceAlreadyExists. Contributed by @kiran01bm.$or operator in subscription filter policies. A policy with a top-level $or key was matched with plain AND semantics, so it never matched and every message was dropped. $or now matches when any member policy matches, with sibling keys AND-ed and nesting supported. Reported by @StiliyanDr.GetMetricData honours MetricStat dimensions. The query resolved by namespace and metric name alone, aggregating across every dimension set and even returning data for a dimension value that was never published. It now filters by the query's exact dimensions, matching GetMetricStatistics. Reported by @boesing.AWS::KMS::Key honours KeySpec and update semantics. The provisioner hard-coded SYMMETRIC_DEFAULT and dropped KeyPolicy/Tags/Enabled, so an asymmetric key reached CREATE_COMPLETE while DescribeKey reported a symmetric key, and had no update handler. It now delegates to CreateKey, applies the mutable properties, fails updates to the immutable ones, and schedules deletion instead of dropping the key. Contributed by @hiddengearz.toMillis(@timestamp) filters and GetQueryResults pagination. The Insights subset ignored filter toMillis(@timestamp) comparisons, so sort+limit returned the wrong edge of the stream, and GetQueryResults returned the full result set regardless of maxItems. Both are now honoured. Contributed by @ovsteenb.AuthorizeSecurityGroupIngress / AuthorizeSecurityGroupEgress echo the existing rule on a duplicate. Both skip a rule that already exists but also dropped it from the response, returning an empty securityGroupRuleSet that panics terraform-provider-aws at SecurityGroupRules[0]. The already-present rule is now echoed with the id DescribeSecurityGroupRules reports. Contributed by @sac-outsystems.redshift, elasticbeanstalk, cloudsearch, sdb, importexport) fell through to S3 and returned a body botocore's query parser can't read, raising a bare KeyError('Error'). Such requests now return a Query <ErrorResponse> envelope (InvalidAction) at HTTP 400.Unknown path where AWS returns data; they now return AWS-shaped responses (operations that need a resource store MiniStack does not keep were left unrouted rather than given a fabricated shape).docker pull ministackorg/ministack:1.4.14 docker run -d -p 4566:4566 ministackorg/ministack:1.4.14
Or pin in compose.yaml:
services:
ministack:
image: ministackorg/ministack:1.4.14
ports:
- "4566:4566"
Issues and PRs welcome on GitHub. Discussion on r/ministack.