Aurora shared storage, Valkey, s3tables CloudFormation, and three more region-isolated services

July 22, 2026 · v1.4.4

v1.4.4 brings the Aurora cluster shared-storage model, ElastiCache Valkey, s3tables CloudFormation plus its Iceberg REST catalog, KMS data key pairs, ALB forwarding to instance/ip targets, AWS::ApiGateway::GatewayResponse CloudFormation support, the Cognito NEW_PASSWORD_REQUIRED Hosted UI flow, region isolation for EventBridge Scheduler, CodeBuild, and Resource Groups, and fixes across Batch, S3, EC2, and Lambda.

RDS — Aurora shared storage and the Data API HTTP endpoint

• Aurora cluster shared-storage model. Aurora MySQL and PostgreSQL cluster members previously provisioned diverging per-instance databases. They now share one cluster-owned container, so tables, users, and grants created through one member are visible through the writer and reader endpoints and the RDS Data API. The local reader endpoint is read/write because it resolves to the same database process. Contributed by @Areson.
• DisableHttpEndpoint. The Data API HTTP endpoint could be enabled via EnableHttpEndpoint but never disabled: DisableHttpEndpoint returned InvalidAction. It now mirrors enable, setting HttpEndpointEnabled to false on the cluster matching ResourceArn. Contributed by @jayjanssen.

ElastiCache — Valkey engine

• Engine=valkey spawns a real Valkey container. Valkey previously fell into the memcached branch, requesting a nonexistent image and falling back to memcached's port 11211. CreateCacheCluster and CreateReplicationGroup now spawn a real valkey/valkey:<major.minor>-alpine container on port 6379 (AWS versions 7.2, 8.0, 8.1), and DescribeCacheEngineVersions lists them with their valkey7/valkey8 parameter-group families. Contributed by @jasondcamp.

KMS — asymmetric data key pairs

• GenerateDataKeyPair and GenerateDataKeyPairWithoutPlaintext. The emulator implemented GenerateDataKey but no data-key-pair operation, so both returned InvalidAction. They now generate an asymmetric data key pair wrapped under a symmetric CMK — the WithoutPlaintext variant omits PrivateKeyPlaintext — across the AWS KeyPairSpec enum, SM2 excluded. Contributed by @yl.

ALB — data-plane forwarding to instance/ip targets

• Requests reach instance/ip targets. The ALB data plane routed live traffic to Lambda targets only; instance/ip target groups returned 502 Target type not supported. Requests are now proxied over HTTP to the registered target with hop-by-hop headers stripped, X-Forwarded-* and X-Amzn-Trace-Id injected, target errors passed through, and connection failures surfaced as 502. Contributed by @jasondcamp.

CloudFormation — GatewayResponse and s3tables

• AWS::ApiGateway::GatewayResponse. CDK/CloudFormation stacks customizing REST API errors rolled back with Unsupported resource type. The API Gateway v1 control plane now serves PutGatewayResponse/GetGatewayResponse(s)/DeleteGatewayResponse, and the resource provisions with in-place updates and generated-default restore on delete. Contributed by @robert-pitt-foodhub.
• s3tables CloudFormation and Iceberg REST. AWS::S3Tables::TableBucket, AWS::S3Tables::Namespace, and AWS::S3Tables::Table now provision through CloudFormation, and the Iceberg REST catalog surface (config, namespaces, tables, load-table, and commit) is served for table buckets, backed by DuckDB. Contributed by @squirmy.

Cognito — Hosted UI password change

• NEW_PASSWORD_REQUIRED in the Hosted UI. A first-login FORCE_CHANGE_PASSWORD user was let straight through the managed-login endpoint, issuing an OAuth code without ever changing the temporary password. The Hosted UI now shows a change-password form, enforces the pool password policy, and completes to the code once the password is set. Contributed by @kjdev.

Multi-region — Scheduler, CodeBuild, and Resource Groups join

• Three more services move to account+region scoped state. EventBridge Scheduler (schedules and schedule groups), CodeBuild (projects and builds), and Resource Groups are now isolated by account and region, so same-name resources in different regions no longer collide. Persisted state carries a versioned regional schema that an older binary refuses rather than misreads, and legacy state migrates by recovering each record's region from its stored ARNs. Contributed by @Areson.

Fixes

• Batch — UpdateComputeEnvironment. Terraform aws_batch_compute_environment with an update_policy block failed with InvalidAction. The endpoint now resolves the compute environment by name or ARN and applies state, serviceRole, computeResources, updatePolicy, unmanagedvCpus, and context. Reported by @smoores-dev.
• S3 — empty object tag value. A bare x-amz-tagging key with no =value was dropped instead of stored; empty tag values are now preserved as a tag with an empty value, matching real S3. Contributed by @murlock.
• EC2 — DescribeSecurityGroupRules by rule id. The operation ignored SecurityGroupRuleIds (a group filter was required) and rule ids shifted when another rule on the group was revoked. Rule ids are now stable and content-derived and SecurityGroupRuleIds is honored, fixing Terraform aws_vpc_security_group_ingress_rule refresh. Reported by @staranto.
• Lambda — docker worker respawn on config change. With LAMBDA_EXECUTOR=docker, UpdateFunctionConfiguration left the old container running with stale config because the reaper matched the pre-region-scoping key shape. It now reaps the function's containers so the next invocation uses the new configuration. Reported by @ykharko.

Upgrade

docker pull ministackorg/ministack:1.4.4
docker run -d -p 4566:4566 ministackorg/ministack:1.4.4

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.4.4
    ports:
      - "4566:4566"