KMS HMAC keys, RDS managed master passwords, EventBridge API destinations, and an S3 conformance batch

August 10, 2026 · v1.4.15

v1.4.15 grows three services and hardens two more. KMS gains HMAC keys with GenerateMac / VerifyMac, RDS wires ManageMasterUserPassword to Secrets Manager, and EventBridge API destinations are now invoked over HTTP on PutEvents. On top of that: a large S3 conformance batch, RDS Data API endpoint fidelity, and SQS, Route 53, and Step Functions parity fixes.

New

• KMS — HMAC keys, GenerateMac, and VerifyMac. The four HMAC key specs (HMAC_224 / HMAC_256 / HMAC_384 / HMAC_512) with KeyUsage=GENERATE_VERIFY_MAC, RFC 2104 generation and constant-time verification (KMSInvalidMacException on mismatch), and DryRun. HMAC keys are rejected by Encrypt / Decrypt / Sign / Verify / GenerateDataKey*; EnableKeyRotation and DisableKeyRotation reject them with UnsupportedOperationException while GetKeyRotationStatus reports KeyRotationEnabled: false, matching AWS. Contributed by @nafdev.
• RDS — ManageMasterUserPassword wires Aurora clusters to Secrets Manager. The flag was ignored: no secret created, no MasterUserSecret returned. It now generates a random master password, stores it in MiniStack's own Secrets Manager under the AWS naming convention (rds!cluster-<uuid>), and returns MasterUserSecret from create / describe / modify. RotateMasterUserPassword rotates the real login and promotes the new credentials to AWSCURRENT, with AWS-exact rejections validated before anything mutates. Contributed by @kiran01bm.
• EventBridge — API destination targets are invoked over HTTP on PutEvents. API destinations and connections were control-plane stubs, so a matching rule dropped the event. Matching events now POST (or the configured method) to the InvocationEndpoint with the input-selected payload; connection authorization is honored (BASIC, API_KEY, and OAUTH_CLIENT_CREDENTIALS with token caching, proactive refresh, and one 401/407 retry), header merging follows the AWS precedence rules, and delivery runs on a background thread. Contributed by @t-rech.
• Lambda — LAMBDA_KEEPALIVE_MS=0 forces a per-invocation cold start. A LocalStack-compat lever (not an AWS behavior): for Docker RIE runtimes (Ruby / Java / .NET), LAMBDA_KEEPALIVE_MS=0 tears the warm container down after each invocation so the next invoke re-runs INIT, for deterministic cold-start isolation in test suites. Unset or any non-zero value keeps the warm-pool behavior. Reported by @mayankgupta57.

Fixes

• S3 — a conformance batch. POST Object no longer misreads ordinary form fields as the object body (only the field literally named file is the body); GetObject with partNumber returns that part as 206 Partial Content; ListObjectVersions emits NextKeyMarker / NextVersionIdMarker when truncated and honors version-id-marker; CompleteMultipartUpload returns 400 MalformedXML for an unparseable body and is idempotent on replay; object owner id is consistent between listings and ACLs; expired presigned URLs return 403 AccessDenied; and conditional deletes honor If-Match (412 PreconditionFailed). Reported by @gaul.
• S3 — CopyObject and HeadObject honour the source versionId. A ?versionId= on the copy source (and on HeadObject) was discarded, so both operated on the current object. CopyObject now copies the exact version and echoes x-amz-copy-source-version-id, HeadObject returns that version's metadata, and a non-existent version is rejected with NoSuchVersion. Reported by @Kaphaalor.
• S3 — NewerNoncurrentVersions survives the lifecycle round-trip. NoncurrentVersionExpiration and NoncurrentVersionTransition dropped the field on PUT/GET, so terraform-provider-aws never converged. It is now emitted and parsed on both rules. Contributed by @sac-outsystems.
• RDS Data API — requests that AWS rejects no longer succeed through permissive fallbacks. A cluster whose HTTP endpoint is not enabled now returns HttpEndpointNotEnabledException; a missing, deletion-scheduled, or password-less secret returns SecretsErrorException / InvalidSecretException; CommitTransaction / RollbackTransaction require resourceArn and secretArn; and a transaction is bound to its originating cluster (a mismatched transaction returns TransactionNotFoundException from execute/batch and NotFoundException from commit/rollback). Contributed by @Areson.
• SQS — FIFO deduplication holds for the full 5-minute window. The dedup entry was cleared when a message was deleted (including the Lambda event-source-mapping consume path), so a duplicate sent seconds after the original was consumed was delivered again. A MessageDeduplicationId is now retained for its full 5-minute window from send time regardless of receive/delete. Reported by @giannimassi.
• Route 53 — ChangeResourceRecordSets DELETE requires the current values to match. A DELETE matched only on name, type, and set identifier, so a delete carrying stale values silently removed the live record. A mismatched DELETE now fails the batch atomically with the AWS-shaped InvalidChangeBatch message, restoring the compare-and-swap semantics guarded-delete workflows rely on. Contributed by @jayjanssen.
• CloudWatch Logs — ARN-based tag operations resolve vended-delivery resources. TagResource / UntagResource / ListTagsForResource only resolved log-group ARNs, so the provider's read-after-create on aws_cloudwatch_log_delivery_source / _destination / _delivery failed with ResourceNotFoundException and broke EventBridge bus-logging stacks. All three now resolve the delivery records' tags. Contributed by @t-rech.
• Step Functions — aws-sdk integration preserves query-protocol singleton lists. The query-XML to JSON converter collapsed a known list wrapper with an irregular item name (e.g. VpcSecurityGroups) into an object when it held a single item. Known wrappers now decode to a list for zero, one, or multiple items. Contributed by @Areson.
• CodeBuild — a timed-out build reports TIMED_OUT. A build stopped by timeoutInMinutes was labelled FAILED, so BatchGetBuilds could not distinguish a timeout from a genuine build failure. It now reports the TIMED_OUT build status, matching AWS.

Upgrade

docker pull ministackorg/ministack:1.4.15
docker run -d -p 4566:4566 ministackorg/ministack:1.4.15

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.4.15
    ports:
      - "4566:4566"