DynamoDB validation parity verified against real AWS, four more region-isolated services, and IoT TopicRule CloudFormation

July 13, 2026 · v1.4.2

v1.4.2 lands a batch of DynamoDB validation-parity fixes verified against real AWS DynamoDB, extends region isolation to SNS, Kinesis, KMS, and ElastiCache, adds AWS::IoT::TopicRule CloudFormation support and Step Functions Lambda write SDK tasks, and fixes WebSocket JWT authorizers, S3 versioned reads after restart, and SQS legacy error codes.

DynamoDB — validation parity with real AWS

• Reads, deletes, batches, and transactions validate like real DynamoDB. Eight gaps where MiniStack silently accepted requests that real AWS rejects, all verified against real AWS DynamoDB: GetItem/DeleteItem/BatchGetItem reject empty string/binary key values; BatchWriteItem validates the whole request before writing anything (a bad member no longer leaves earlier members applied); TransactWriteItems validates every member up front and matches AWS's two failure shapes — empty key values are a top-level ValidationException, while wrong-typed keys and update-expression type errors cancel the transaction with a positional ValidationError reason; Query rejects inverted BETWEEN bounds at parse time, empty key-condition operands, and an ExclusiveStartKey outside the range predicate; UpdateItem SET rejects unresolvable document paths (list_append on a missing attribute), and ADD/DELETE enforce operand types with the exact AWS error strings. Contributed by @ifutivic.
• Query/Scan return LastEvaluatedKey when results end exactly at Limit. Real DynamoDB doesn't look ahead: stopping because of the limit always yields a key, and the follow-up page comes back empty with no key. SDK pagination helpers that treat the key as "has more pages" now behave identically against MiniStack and AWS. Contributed by @ifutivic.

Multi-region — SNS, Kinesis, KMS, and ElastiCache join

• Four more services move to account+region scoped state, continuing the 1.4.0 multi-region work: SNS (topics, subscriptions, platform applications and endpoints), Kinesis (streams, shard iterators — which now survive a warm boot, still subject to their 5-minute expiry — and consumers), KMS (keys and aliases — the same alias name can target different keys per region, as on AWS), and ElastiCache (all resource stores; local container names now carry account and region so same-name clusters coexist). Same-name resources in different regions no longer collide, and legacy persisted state migrates by recovering each record's region from its ARNs. Contributed by @Areson.

IoT — TopicRule CloudFormation

• AWS::IoT::TopicRule deploys. Previously it failed with Unsupported resource type and rolled the stack back. The provisioner normalizes the PascalCase TopicRulePayload to the API's camelCase shape, Ref/Fn::GetAtt Arn work, and the IoT control plane gains CreateTopicRule, GetTopicRule, ListTopicRules, ReplaceTopicRule, and DeleteTopicRule. Contributed by @maximoosemine.

Step Functions — Lambda write SDK tasks

• aws-sdk:lambda write actions dispatch. createFunction, updateFunctionConfiguration, updateFunctionCode, createAlias, and updateAlias now run through the Lambda REST emulator (previously States.Runtime: not yet implemented). The SFN SDK-convention KmsKeyArn parameter maps to Lambda's wire-form KMSKeyArn instead of being silently ignored, and Lambda errors surface with prefixed codes so Catch clauses match. Contributed by @Areson.

API Gateway v2

• WebSocket $connect invokes JWT authorizers. A JWT authorizer on the $connect route was ignored, so any client could connect without a token. It's now validated like the HTTP API path: missing or invalid tokens close the connection with code 1008, and validated claims and scopes land in requestContext.authorizer.jwt. Reported by @Lukasdoe.

S3 and SQS

• Versioned GetObject returns the body after a restart with S3_PERSIST=1. Version records live in memory only, so a versioned read after restart found the restored version id but no data. Restore now seeds the current version from the on-disk sidecar and versioned reads fall back to the persisted body. Reported by @adzcodemi.
• SQS XML error responses carry the legacy query-protocol codes. SDKs on the legacy query protocol match namespaced codes like AWS.SimpleQueueService.NonExistentQueue; the XML <Code> element now carries the same awsQueryCompatible mapping already sent on the JSON path. Reported by @play4uman.

Upgrade

docker pull ministackorg/ministack:1.4.2
docker run -d -p 4566:4566 ministackorg/ministack:1.4.2

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.4.2
    ports:
      - "4566:4566"