Aurora reader replication, IoT Jobs, and an S3 correctness pass

August 19, 2026 · v1.4.20

v1.4.20 grows the data plane and tightens the edges. RDS gains opt-in Aurora PostgreSQL reader instances backed by real streaming replication and a working FailoverDBCluster; AWS IoT Jobs lands with its iot-jobs-data device plane; and CloudFormation learns API Gateway keys and usage plans. Around that is a broad S3 correctness pass — server-side encryption is now real contract state, CRC64NVME checksums compute instead of erroring, and versioning, canned ACLs and conditional multipart all move closer to AWS — plus parity fixes in DynamoDB, CloudWatch, EC2, IAM, Step Functions and Aurora DSQL.

New

• RDS — opt-in Aurora PostgreSQL reader replication. With MINISTACK_RDS_PG_CLUSTER_REPLICATION=1, the second and later members of an Aurora PostgreSQL cluster launch their own PostgreSQL containers, cloned from the writer with pg_basebackup and streaming WAL as hot standbys. A reader is genuinely read-only (pg_is_in_recovery() is true, writes fail with 25006), sees the writer's data, and the cluster ReaderEndpoint resolves to an available reader — so read/write routing, replica lag and reader-endpoint pooling can be rehearsed locally. Off by default; Aurora MySQL and the no-flag path keep aliasing the writer's shared container. Contributed by @kiran01bm.
• RDS — FailoverDBCluster. Forcing an Aurora failover was InvalidAction; it now promotes a reader to writer. An explicit TargetDBInstanceIdentifier must be an available reader in the cluster, or the lowest-PromotionTier reader is chosen; the response reports the transitional failing-over status and a follow-up DescribeDBClusters shows available with flipped IsClusterWriter flags, mirroring FailoverGlobalCluster. Contributed by @kiran01bm.
• AWS IoT Jobs — control plane and device data plane. CreateJob used to fall through to Unsupported IoT path and the iot-jobs-data endpoint did not exist, so device OTA loops could not be rehearsed. The iot service now serves the nine job operations and a new iot-jobs-data service the device ones (including the $next sentinel), sharing one store and the AWS execution state machine. Contributed by @iot-rocket.
• CloudFormation — API Gateway (v1) API keys and usage plans. AWS::ApiGateway::ApiKey, AWS::ApiGateway::UsagePlan and AWS::ApiGateway::UsagePlanKey failed with Unsupported resource type; they now provision through the same stores the runtime APIs use, with Ref and Fn::GetAtt wired, unblocking CDK RestApi / ApiKey and Terraform aws_api_gateway_api_key through CloudFormation. Contributed by @ryan-bennett.

Fixes

• S3 — server-side encryption is stated, validated and enforced. SSE-S3, SSE-KMS and SSE-C headers were accepted and then forgotten. MiniStack still does not encrypt at rest, but SSE is now contract state: validated on write, persisted so HEAD/GET echo it, and enforced for SSE-C — a keyless or plain-object read is a 400 InvalidRequest, a wrong-key read a 403 AccessDenied, following versions, copies and multipart completes. Contributed by @gaul.
• S3 — CRC64NVME checksums are computed instead of refused. CRC-64/NVME is what current SDKs and the CLI checksum with by default, and MiniStack answered InvalidRequest, so a stock aws s3 cp failed before it began. It is now computed from a stdlib table (no new dependency): uploads validate a client-supplied value with BadDigest on mismatch, and GET/HEAD return it. CRC32C still requires its native library. Contributed by @gaul.
• S3 — versioning edge cases. The null version, suspended-bucket writes and delete-marker signals now match AWS: a suspended PUT/DELETE lands under the literal null id, a pre-versioning object stays addressable as VersionId=null, DeleteObjects mints and reports markers, a marker-hidden 404 carries x-amz-delete-marker: true, and UploadPartCopy honors the source ?versionId=. Contributed by @gaul.
• S3 — canned ACLs are stored, and object ACLs bind to versions. PutBucketAcl --acl public-read arrives as an x-amz-acl header with an empty body and was dropped, so buckets read back owner-only; the canned value is now validated and stored (bucket and CreateBucket), and object ACLs are per-version like tags. Contributed by @gaul.
• S3 — CompleteMultipartUpload honors If-Match / If-None-Match. Conditional writes were evaluated on PutObject but ignored on the multipart path, so a create-once or compare-and-swap upload could silently overwrite; the complete now evaluates the same preconditions (412 on violation, 404 NoSuchKey for an If-Match on a missing object). Contributed by @gaul.
• S3 — presigned SigV4 URLs verify for virtual-hosted addressing and temporary credentials. A virtual-hosted URL was rewritten to path-style before its signature was recomputed, and a URL signed with STS temporary credentials was checked against the static server secret; verification now runs against the original signed URI and against the secret STS actually issued. Reported by @mayankgupta57.
• DynamoDB — key attribute types are enforced on PutItem, Query and UpdateTable. A key declared S accepted an N value on write and in a key condition, and an attribute-definitions-only UpdateTable changed a key's type in place; all three now return the AWS ValidationException so no API changes a key's type. Reported by @iot-rocket.
• CloudWatch — extended-statistic percentiles are computed instead of aliased to Average. GetMetricData and alarm evaluation returned Average for any pNN statistic; percentiles are now interpolated from the period's samples on both paths, and a percentile alarm's StateReason reports the actual statistic (e.g. p95). Contributed by @MGSousa.
• EC2 — instance public IP and DNS reach the SDKs. DescribeInstances / RunInstances emitted the address under publicIpAddress / publicDnsName rather than the wire tags ipAddress / dnsName, so every SDK dropped both; they now ride the real tags, and generated addresses are completed to four octets. Contributed by @iot-rocket.
• Step Functions — arn:aws:states:::events:putEvents actually publishes. The optimized EventBridge integration fell through to the task passthrough, so the state reported SUCCEEDED while nothing reached any rule target; it now calls EventBridge PutEvents and returns its response. Reported by @iwasakar.
• IAM — role Description charset is validated. CreateRole, UpdateRole and UpdateRoleDescription now reject a description outside IAM's allowed character set or longer than 1000 characters with a 400 ValidationError. Reported by @iot-rocket.
• Aurora DSQL — SELECT ... FOR UPDATE is no longer refused for its predicate. Strict mode enforced a rule DSQL does not: measured against a live cluster, DSQL restricts the lock strength, not the predicate. FOR UPDATE now locks whatever the query selects (no WHERE, non-key columns, joins, keyless tables all succeed), while FOR NO KEY UPDATE / FOR SHARE / FOR KEY SHARE are refused — so the emulator stops failing correct ORM code.
• Aurora DSQL — quoted identifiers are normalized the way the server stores them. DROP COLUMN "ID" and mixed-case or schema-qualified table names were mis-resolved; identifiers are now folded as PostgreSQL folds them (bare to lower case, quoted verbatim) and the relation is requoted part by part before lookup.
• CloudFormation — AWS::IoT::Policy updates apply instead of rolling back. The type had no update handler, so an edit fell through to create, hit ResourceAlreadyExistsException and rolled back; a changed PolicyDocument is now a no-interruption update stored as a new default version (pruning the oldest to stay under IoT's five-version cap), and a changed PolicyName is a replacement.
• CloudFormation — auto-generated physical names keep their uniqueness suffix when truncated. A deeply nested stack whose generated name exceeded a resource's name cap truncated every resource to the same string and collapsed them onto one physical resource; the hash suffix that guarantees uniqueness is now always preserved, matching AWS and the CDK. Contributed by @ryan-bennett.
• CloudFormation — AWS::SSM::Parameter goes through the SSM API. Provisioning now writes through the API, so a create over an existing name fails (ParameterAlreadyExists), updates increment Version and record history, a Name change replaces, a SecureString type is rejected, and Fn::GetAtt exposes Arn / Type / Value; a Parameter::Value<...> reference is re-resolved on UpdateStack. Reported by @iot-rocket.

Upgrade

docker pull ministackorg/ministack:1.4.20
docker run -d -p 4566:4566 ministackorg/ministack:1.4.20

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.4.20
    ports:
      - "4566:4566"