CloudFormation resource coverage, OpenSearch packages, Cognito session refresh, and Batch/SES region isolation

July 22, 2026 · v1.4.5

v1.4.5 is a CloudFormation coverage release: eight resource types that used to roll a stack back with Unsupported resource type now provision cleanly — across API Gateway, Lambda, CloudWatch, OpenSearch, and Cognito. It also adds OpenSearch package management, the Cognito GetTokensFromRefreshToken action that aws-amplify v6.15+ depends on, region isolation for Batch and SES, and fixes across CloudFront, SQS, API Gateway, EC2, and Lambda.

CloudFormation — eight new resource types

• AWS::ApiGateway::Model. Stacks with request/response models failed with Unsupported resource type: AWS::ApiGateway::Model. Models now create, update, and delete against the v1 model store; JSON-valued schemas are normalized to the API's string representation and Ref returns the model name. Contributed by @robert-pitt-foodhub.
• AWS::ApiGateway::DomainName. CDK custom-domain stacks rolled back with Unsupported resource type. Regional and edge domains now provision through the v1 control plane; Ref returns the domain name and Fn::GetAtt exposes DistributionDomainName, DistributionHostedZoneId, DomainNameArn, RegionalDomainName, and RegionalHostedZoneId. Contributed by @robert-pitt-foodhub.
• AWS::ApiGateway::BasePathMapping. Base path mappings now create, update, replace, and delete; an omitted BasePath maps to the root (none) mapping. Contributed by @robert-pitt-foodhub.
• AWS::ApiGateway::DocumentationPart. The native documentation-part control plane (CreateDocumentationPart/GetDocumentationPart(s)/UpdateDocumentationPart/DeleteDocumentationPart) plus the CloudFormation resource type; Ref returns the part id and Fn::GetAtt DocumentationPartId is exposed. Contributed by @robert-pitt-foodhub.
• AWS::Lambda::EventInvokeConfig. CDK stacks configuring asynchronous retry limits, maximum event age, or on-success/on-failure destinations rolled back with Unsupported resource type. Configs are now isolated per function qualifier (version/alias), and GetFunctionEventInvokeConfig/ListFunctionEventInvokeConfigs return them per qualifier. Contributed by @robert-pitt-foodhub.
• AWS::CloudWatch::Dashboard. Dashboards now create, update the body in place, replace on a name change, and delete; Ref returns the dashboard name. Contributed by @robert-pitt-foodhub.
• AWS::OpenSearchService::Domain. Domains and CDK-generated access policies now provision through CloudFormation with in-place updates, replacement, rollback, and Fn::GetAtt for the domain ARN and endpoint. Contributed by @robert-pitt-foodhub.
• AWS::Cognito::UserPoolGroup. The raw group APIs existed but the CFN resource type failed the whole stack; groups now provision through CloudFormation, Ref returns the group name, and deletion removes the group from its member users. Contributed by @ryan-bennett.

OpenSearch — package management

• Packages. CreatePackage, UpdatePackage, DescribePackages, DeletePackage, AssociatePackage, DissociatePackage, and ListPackagesForDomain are now served. Packages report AVAILABLE and domain associations ACTIVE immediately, so a poll after create, update, or associate succeeds on the first call — the workflow behind a synonyms-file update loop. Reported by @Simon-Hayden-Dev.

Cognito — resource servers and session refresh

• Resource servers. CreateResourceServer, UpdateResourceServer, DescribeResourceServer, DeleteResourceServer, and ListResourceServers, plus AWS::Cognito::UserPoolResourceServer CloudFormation support. Every action previously returned InvalidAction: Unknown Cognito IDP action. Resource servers are keyed by their caller-supplied Identifier within a pool, matching real AWS, and Ref on the CFN resource returns that Identifier — unblocking custom OAuth scopes for API Gateway HttpJwtAuthorizer gating. Contributed by @ryan-bennett.
• GetTokensFromRefreshToken. aws-amplify v6.15+ refreshes sessions exclusively through this action, which returned InvalidAction — so Amplify apps signed in fine but silently lost the session when the access token expired (about an hour in), presenting as random logouts in local dev. It now returns the same AuthenticationResult shape as REFRESH_TOKEN_AUTH; refresh token rotation and RefreshTokenReuseException are not modeled. Reported by @scriptgenerator64.

Multi-region — Batch and SES join

• Two more services move to account+region scoped state. AWS Batch (compute environments, job queues, job definitions, jobs) and SES/SESv2 (identities, templates, configuration sets, send statistics, tags) are now isolated by account and region, so same-name resources in different regions no longer collide. Persisted state carries a versioned regional schema that an older binary refuses rather than misreads, and legacy state migrates by recovering each record's region from its stored ARNs. Contributed by @Areson.

Fixes

• CloudFront — invalidations on CloudFormation-created distributions. CreateInvalidation on a distribution provisioned through CloudFormation raised a KeyError because the CFN path never initialized the invalidation store the native CreateDistribution does. The store is now initialized on create and cleaned up on delete. Contributed by @robert-pitt-foodhub.
• CloudFormation/Lambda — CDK S3 bucket notification custom resources no longer hang. Custom-resource properties reached CDK's bundled handler as Python bool/numbers instead of CloudFormation's string wire representation (it called .lower() on Managed), and the warm Python worker omitted log_stream_name, so the failure path couldn't PUT to the ResponseURL and the stack hung until the one-hour service timeout. Properties now use the string representation and warm workers expose the standard Lambda context fields. Contributed by @robert-pitt-foodhub.
• API Gateway — AWS::ApiGateway::Stage Ref. Ref returned <api-id>-<stage> instead of the stage name, so dependent resources failed GetStage with Invalid Stage identifier specified. Ref now returns the stage name, matching AWS. Contributed by @robert-pitt-foodhub.
• SQS — ListQueues pagination. Results were silently truncated at MaxResults and no NextToken was returned or accepted, so a client with more than 1000 queues could not enumerate them all. ListQueues now returns a NextToken when more results remain and accepts it on the next page, across both the JSON and Query/XML protocols. Contributed by @bfreitastgtg.
• EC2 — DescribeSecurityGroupRules tags. The operation omitted each rule's Tags and SecurityGroupRuleArn, so Terraform's aws_vpc_security_group_ingress_rule saw perpetual tags_all drift. Rule tags set at authorize time (or via CreateTags on the sgr- id) are now stored and returned along with the rule ARN, and tag:/tag-key filters are honored. Reported by @staranto.
• Cognito — AWS::Cognito::UserPool LambdaConfig dropped by CloudFormation. The CFN provisioner built a pool's state without reading LambdaConfig, so Lambda triggers configured on a CFN-provisioned pool were silently never invoked, even though the raw CreateUserPool API honored it. LambdaConfig is now copied onto the pool the same way the raw API does. Contributed by @ryan-bennett.

Upgrade

docker pull ministackorg/ministack:1.4.5
docker run -d -p 4566:4566 ministackorg/ministack:1.4.5

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.4.5
    ports:
      - "4566:4566"