Device shadows over MQTT, MQTT 5.0, and a CA-certificate registry

August 17, 2026 · v1.4.19

v1.4.19 is an IoT-heavy release: device shadows now flow over the MQTT broker at the AWS reserved topics, the broker negotiates MQTT 5.0 per connection, a CA-certificate registry lands with just-in-time-registration events, connectivity.* terms join the fleet index, and the sqs topic-rule action dispatches. On top of that: an EventBridge event-pattern matcher rewritten to AWS's real semantics, Cognito federation endpoints built from the user pool domain, a DynamoDB stream-ARN fix, and a Lambda deployment-size fix that counts layers.

New

• IoT Core — device shadows over MQTT. The classic and named device-shadow operations are served over the broker at the AWS reserved topics: publishing to $aws/things/<thing>/shadow[/name/<name>]/{get,update,delete} drives the same shadow store the HTTP data plane uses and replies on the matching accepted / rejected topics, with update also publishing delta and documents. Malformed JSON is rejected on the verb's rejected topic, and every response echoes the request's clientToken. Contributed by @iot-rocket.
• IoT Core — MQTT 5.0 negotiated per connection. The broker negotiates its wire format from the CONNECT packet's protocol level: a 5.0 client receives property blocks, subscription options and reason codes, a 3.1.1 client keeps getting the exact bytes it did before, and a message crosses between the two versions. The CONNACK advertises AWS's server capabilities — Maximum QoS 1, Maximum Packet Size 128 KB, retain and wildcard subscriptions — and features the broker does not implement are advertised as unavailable. Contributed by @iot-rocket.
• IoT Core — CA-certificate registry and JIT-registration events. RegisterCACertificate and friends (DescribeCACertificate / UpdateCACertificate / ListCACertificates / DeleteCACertificate, plus GetRegistrationCode / DeleteRegistrationCode) are served. Deleting an ACTIVE CA is CertificateStateException (406), a duplicate is ResourceAlreadyExistsException (409), and RegisterCertificate validates caCertificatePem against the signing CA (else CertificateValidationException, 400). Registering under an ACTIVE auto-registration CA publishes the JITR event to $aws/events/certificates/registered/{caCertificateId}. Contributed by @iot-rocket.
• IoT Core — connectivity.* terms in the fleet index. With thingConnectivityIndexingMode: STATUS, SearchIndex answers connectivity.connected / connectivity.timestamp / connectivity.disconnectReason, and DescribeIndex's schema reports ..._AND_CONNECTIVITY_STATUS. connected is derived from the live session registry — a thing is connected while a session whose client id equals the thing name is live — so it cannot drift or survive a restart. Contributed by @iot-rocket.
• IoT Core — the sqs topic-rule action. A rule carrying {"sqs": {...}} was stored and dispatched nothing; the payload now goes through SQS's own SendMessage, so the queue's DelaySeconds and size limit apply, useBase64 Base64-encodes the body, an unresolvable queue reaches the rule's errorAction, and FIFO destinations are refused as on AWS. Contributed by @iot-rocket.

Fixes

• EventBridge — event-pattern matching follows AWS. The matcher was rewritten to AWS's real semantics: a pattern whose only key is $or (or whose keys are all unrecognized) no longer matches every event, $or is expanded with last-write-wins and the 1000-combination cap, wildcard treats only * as special, exists works on leaf nodes, resources is an OR, and cidr / equals-ignore-case / case-insensitive prefix/suffix are evaluated. An unparseable pattern is rejected with InvalidEventPatternException. Contributed by @t-rech.
• Cognito — federation endpoints are built from the user pool's domain. The SAML ACS URL and OIDC federation callback ignored the pool domain and were built from the local host, so external IdPs got redirect_uri=http://localhost:4566/oauth2/idpresponse and rejected the flow. /saml2/idpresponse and /oauth2/idpresponse are now derived from the pool's domain (custom or the regional Cognito host), and CustomDomainConfig is honored on CreateUserPoolDomain. Contributed by @tema-mazy.
• DynamoDB — enabling a stream through UpdateTable sets the stream ARN. UpdateTable with StreamEnabled=true stored the specification but left LatestStreamArn unset, so aws_dynamodb_table.stream_arn came back empty in Terraform. It now mints the label and ARN on the disabled→enabled transition, as CreateTable does, and DescribeStream resolves it. Contributed by @nightcityblade. Reported by @wparad.
• Lambda — the 250 MB unzipped limit counts function code plus layers. The unzipped-size check ran on the deployment package alone, so a function whose code and layers exceeded 250 MB together (each under the limit individually) was accepted, unlike AWS. CreateFunction and UpdateFunctionCode now sum the code and every attached layer, unzipped, and reject a total over 262144000 bytes with InvalidParameterValueException. Reported by @iot-rocket.

Upgrade

docker pull ministackorg/ministack:1.4.19
docker run -d -p 4566:4566 ministackorg/ministack:1.4.19

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.4.19
    ports:
      - "4566:4566"