Aurora DSQL emulator, API Gateway Lambda authorizers, and CloudFormation update fidelity

August 12, 2026 · v1.4.16

v1.4.16 adds a new service and hardens three more. Aurora DSQL arrives as a control-plane emulator with an optional real-Postgres backend, API Gateway (REST) now invokes custom Lambda authorizers on the request path, and CloudFormation stack updates stop duplicating and misresolving resources. On top of that: S3 versioned-metadata and GetBucketLocation fixes, and a Route 53 PENDING change.

New

• Aurora DSQL — a control-plane emulator. A control plane over the Aurora DSQL REST-JSON API: cluster lifecycle, cluster tags, and cluster policies, with clientToken create-idempotency, deletionProtectionEnabled enforcement, and expectedPolicyVersion optimistic concurrency on policy writes. With DSQL_STRICT=1 and a Docker daemon, each cluster is backed by a real Postgres container fronted by an in-process Postgres wire-protocol proxy that validates statements against DSQL's SQL subset; without strict mode a cluster goes ACTIVE metadata-only. Tunable via DSQL_BASE_PORT / DSQL_STRICT / DSQL_PERSIST / DSQL_PG_IMAGE. Contributed by @ry-allan.

Fixes

• CloudFormation — stack updates no longer duplicate or misresolve resources. An unchanged resource was reprocessed on every update, and a type with no update handler fell back to create with a fresh random name, orphaning the real resource (and any Ref/Fn::GetAtt to it); unchanged resources are now skipped and auto-generated names are a deterministic hash of (stack name, logical id), which also fixes the AWS::Events::EventBus "already exists" update failure. AWS::ApiGatewayV2::Authorizer now survives a property update instead of minting a second, orphaned authorizer, and AWS::SSM::Parameter::Value<...> template parameters resolve against Parameter Store instead of passing the name through. Contributed by @ryan-bennett.
• CloudFormation — a DELETE_COMPLETE stack's name can be re-created. A deleted stack stayed addressable by name, so aws cloudformation deploy took the update path ("cannot be updated") instead of re-creating. A deleted stack is now addressable only by its unique stack ID; describe / update / change-set by name report "does not exist", so the name re-deploys as a fresh stack. Reported by @iot-rocket.
• S3 — versioned objects retain their custom metadata. The per-version record dropped x-amz-meta-*, preserved headers, and content-encoding, and a versioned GetObject/HeadObject bypassed the metadata emitter; each version now stores and returns its own metadata. Reported by @Kaphaalor.
• S3 — GetBucketLocation returns the bucket's stored region. The location was compared against the configurable default region (so a non-us-east-1 default blanked it) and buckets created without a LocationConstraint stored no region; a bucket now records its signing region and GetBucketLocation echoes it, returning empty only for us-east-1. Contributed by @iot-rocket.
• API Gateway (REST) — custom Lambda authorizers are enforced on the request path. A method with authorizationType: CUSTOM stored its authorizer but never called it, so requests reached the integration unauthenticated. TOKEN and REQUEST authorizers now run on the data path: 401 on a missing identity source, 403 on an explicit Deny or no-matching-Allow, authorizerResultTtlInSeconds caching, and the returned context (stringified) plus principalId injected into requestContext.authorizer. AWS_IAM methods require an Authorization header (403); an unsupported resource or method now returns 403 Missing Authentication Token rather than 404/405. Reported by @iot-rocket.
• Route 53 — a change is born PENDING then flips to INSYNC. Every ChangeResourceRecordSets / CreateHostedZone change was created INSYNC, so GetChange never returned PENDING and waiters completed on their first read. Changes are now submitted PENDING and flip to INSYNC on the first GetChange read. Reported by @jayjanssen.

Upgrade

docker pull ministackorg/ministack:1.4.16
docker run -d -p 4566:4566 ministackorg/ministack:1.4.16

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.4.16
    ports:
      - "4566:4566"