Seven more CloudFormation resource types, Aurora MySQL global replication, and nine services region-isolated

July 24, 2026 · v1.4.6

v1.4.6 continues the CloudFormation coverage push — seven more resource types that used to roll a stack back with Unsupported resource type now provision cleanly, across EC2, API Gateway, AppSync, Lambda, CloudWatch Logs, and CloudFront. It also adds REST API exports, GTID-based Aurora MySQL global replication, region isolation for nine more services, and fixes to Cognito Hosted UI sign-in and Docker-executed Lambda custom resources.

CloudFormation — seven new resource types

• AWS::EC2::VPCEndpoint. VPC endpoints now provision through CloudFormation into the shared EC2 state, so DescribeVpcEndpoints returns them; Ref returns the vpce- id and Fn::GetAtt exposes Id. Endpoint type, VPC/route/subnet/security-group associations, tags, and in-place updates are supported. Contributed by @robert-pitt-foodhub.
• AWS::ApiGateway::DocumentationVersion. Documentation versions now create, update, and replace through CloudFormation; Ref returns the {RestApiId}/{DocumentationVersion} identity, and a version change triggers replacement. Contributed by @robert-pitt-foodhub.
• AWS::ApiGateway::RequestValidator. Request validators now provision through CloudFormation; both Ref and Fn::GetAtt RequestValidatorId return the validator id. A Name or RestApiId change triggers replacement while the validation flags update in place. Contributed by @robert-pitt-foodhub.
• AWS::AppSync::FunctionConfiguration. Pipeline functions now provision through CloudFormation; Ref returns the function ARN and Fn::GetAtt exposes FunctionArn, FunctionId, Name, and DataSourceName. An ApiId change triggers replacement. Contributed by @robert-pitt-foodhub.
• AWS::Lambda::Url. Function URLs now provision through CloudFormation and share the Function URL API state; Fn::GetAtt exposes FunctionArn and FunctionUrl, AuthType/InvokeMode/Cors update in place, and a TargetFunctionArn or Qualifier change triggers replacement. UpdateFunctionUrlConfig now also applies InvokeMode. Contributed by @robert-pitt-foodhub.
• AWS::Logs::ResourcePolicy. Resource policies now provision through CloudFormation; Ref returns the PolicyName, a policy-document change updates in place, and a PolicyName change triggers replacement. Contributed by @robert-pitt-foodhub.
• AWS::CloudFront::CloudFrontOriginAccessIdentity. Origin access identities now provision through CloudFormation; Ref returns the identity id (E…) and Fn::GetAtt exposes Id and S3CanonicalUserId, both retained across comment updates. Contributed by @robert-pitt-foodhub.

API Gateway — REST API exports

• GetExport. A REST API stage can now be exported as OpenAPI 3 (oas30) or Swagger 2 (swagger), in JSON or YAML, with the optional integrations extension included on request. Contributed by @robert-pitt-foodhub.

RDS — Aurora MySQL global replication

• Global writer to secondary-region readers. Aurora MySQL 8 global clusters now replicate from the global writer to secondary-region readers over GTID-based binary log replication, with binlog retention bounded on the source and fail-closed handling for volumes initialized by an older version. Contributed by @Areson.

Multi-region — nine more services

• Athena, Auto Scaling, Cloud Map, EFS, EMR, Inspector2, Amazon MQ, AppSync, and S3 Files move to account+region scoped state. Same-name resources in different regions no longer collide. Persisted state carries a versioned regional schema (on-disk format v3) that an older binary refuses rather than misreads, and legacy state migrates by recovering each record's region from its stored ARNs. Contributed by @Areson.

Fixes

• API Gateway v2 — queryStringParameters/body sent as null instead of omitted. The HTTP API v2 Lambda proxy event included queryStringParameters/body with a null value when a request had no query string or no payload, rather than omitting the key as real AWS does. Strict event-shape validators (for example AWS Lambda Powertools' isAPIGatewayProxyEventV2) reject null, so every bodyless or querystring-less request against such a validator failed with an unhandled InvalidEventError, even though the invocation itself succeeded. Contributed by @ryan-bennett.
• Cognito — Hosted UI bound the authorization code to the raw email alias instead of the resolved Username. In pools with UsernameAttributes or AliasAttributes, the email entered on the Hosted UI login page was bound to the authorization code verbatim, so the code exchange keyed off the alias rather than the user's real Username. The login and new-password submit paths now bind the code to the Username resolved by the alias lookup. Contributed by @kjdev.
• CloudFormation/Lambda — Docker-executed custom resources hung because the ResponseURL used localhost. With LAMBDA_EXECUTOR=docker, a Lambda-backed custom resource completed its work but could not post its completion callback: the ResponseURL pointed at localhost, which inside the Lambda container resolves to the container itself rather than the host running MiniStack, so the PUT failed with connection refused and the stack sat in CREATE_IN_PROGRESS until the one-hour service timeout. The ResponseURL handed to a container-executed custom resource now rewrites localhost/127.0.0.1 to host.docker.internal, the same host already used for AWS_ENDPOINT_URL; explicitly configured hostnames are left untouched. Reported by @robert-pitt-foodhub.

Upgrade

docker pull ministackorg/ministack:1.4.6
docker run -d -p 4566:4566 ministackorg/ministack:1.4.6

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.4.6
    ports:
      - "4566:4566"