July 26, 2026 · v1.4.7
v1.4.7 adds a new service — Amazon Bedrock AgentCore — and makes Kinesis Data Firehose actually write to Apache Iceberg (S3 Tables) rather than just provision the stream. It also fills S3's GetObjectAttributes and SNS's ListPlatformApplications gaps, moves three more services to region-isolated state, and lands parity fixes across DynamoDB, S3 Tables, Lambda, SQS, and Cognito.
bedrock-agentcore-control endpoint implements CreateAgentRuntime, GetAgentRuntime, ListAgentRuntimes, UpdateAgentRuntime, DeleteAgentRuntime, ListAgentRuntimeVersions, and the runtime-endpoint operations (CreateAgentRuntimeEndpoint, GetAgentRuntimeEndpoint, ListAgentRuntimeEndpoints, UpdateAgentRuntimeEndpoint, DeleteAgentRuntimeEndpoint); the bedrock-agentcore data-plane endpoint implements InvokeAgentRuntime. CreateAgentRuntime reports CREATING and UpdateAgentRuntime reports UPDATING before settling to READY, each update bumps agentRuntimeVersion, ARNs follow the real agent/{uuid}:{version} and agentEndpoint/{uuid} shapes, and all state is account+region scoped. InvokeAgentRuntime returns a deterministic echo of the request payload — no container or model is executed — so teams can test runtime lifecycle, endpoint wiring, and Invoke request/response contracts locally without live AWS. Reported by @wolfgangmeyers.GetObjectAttributes. GET /{bucket}/{key}?attributes previously returned the object body; it now returns a GetObjectAttributesResponse carrying only the fields named in the required x-amz-object-attributes header (ETag, Checksum, ObjectParts, StorageClass, ObjectSize). The ETag is emitted without the surrounding quotes the HTTP header carries, StorageClass is omitted for S3 Standard objects as on AWS, Checksum reports the object's stored checksum with its ChecksumType, and ObjectParts lists the parts of a multipart-completed object. It honors versionId and returns NoSuchKey/NoSuchBucket for missing objects. Reported by @JayJuch.ListPlatformApplications. The mobile-push action returned InvalidAction even though platform applications created with CreatePlatformApplication were already stored. It now lists the caller's platform applications with their attributes and NextToken pagination; results are account+region scoped, matching AWS's per-region platform applications. Reported by @ctalibard-sk.IcebergDestinationConfiguration now actually writes records into the target S3 Tables Iceberg table, not just provisions the stream. Each record routes to its destination table from the DestinationTableConfigurationList (or a transform Lambda's metadata.otfMetadata), and the row operation follows real Firehose Merge-on-Read semantics: insert by default, update/delete matched on the table's UniqueKeys (a record whose operation needs keys but has none is dropped to the error path, as on AWS). Rows are written through the S3 Tables Iceberg REST catalog using the bundled DuckDB engine and are immediately queryable. Reported by @ryan-bennett.AWS::KinesisFirehose::DeliveryStream CloudFormation support. Stacks containing a delivery stream failed with Unsupported resource type even though the Firehose API already implemented CreateDeliveryStream. The resource now provisions through CloudFormation into the existing Firehose control plane (S3, Extended S3, Iceberg, and the other destination configs), Ref returns the delivery stream name, and Fn::GetAtt Arn returns its ARN. Contributed by @squirmy. Reported by @ryan-bennett.CreateTable validates index Projection settings and rejects a StreamSpecification with StreamEnabled: false alongside a StreamViewType, UpdateTable merges and prunes AttributeDefinitions, secondary-index key attributes reject wrong-typed/non-scalar/empty values, sparse composite indexes exclude items missing their range key, PartiQL UPDATE/DELETE return {"Items": []}, and eventually-consistent reads now meter 0.5 RCU./iceberg endpoints returned {"__type": "NotFoundException", ...} on a missing namespace or table, but the Iceberg REST OpenAPI requires {"error": {"message", "type", "code"}}. Spec-compliant REST clients (DuckDB, Spark, Trino) treat a LoadTable 404 as "proceed to create", but only when it is a proper NoSuchTableException, so the AWS shape made them abort. The /iceberg surface now uses the REST spec envelope, leaving the S3 Tables control plane's AWS error shape unchanged.invalid mount config for type "bind". When MiniStack ran inside a container and LAMBDA_REMOTE_DOCKER_VOLUME_MOUNT was set, the runtime container was created with a bind mount whose source was the volume name rather than an absolute path. In-container runs now always populate the sibling container's /var/task (and /var/runtime for provided.*) via docker cp over the host socket — no shared volume required. LAMBDA_REMOTE_DOCKER_VOLUME_MOUNT is deprecated and ignored. Reported by @smoores-dev.QueueUrl used a hardcoded localhost host, breaking Docker-executed Lambdas. CreateQueue, GetQueueUrl, and ListQueues now render QueueUrl(s) using the caller's incoming Host header (for example host.docker.internal:4566); internal queue state stays keyed on canonical URLs. An explicitly configured MINISTACK_HOST pins the host and disables the rewrite. Contributed by @thejusdutt. Reported by @Millroy094.UsernameAttributes used the raw email or phone number as Username instead of a generated UUID. In a pool configured for email or phone sign-in, AdminCreateUser returned the submitted email/phone as the Username, but real Cognito treats that value as an alias and assigns an immutable system-generated UUID. The Username is now a UUID for UsernameAttributes pools, the alias resolution paths key off it, and changing the email attribute afterwards no longer changes the Username. Contributed by @kjdev.docker pull ministackorg/ministack:1.4.7 docker run -d -p 4566:4566 ministackorg/ministack:1.4.7
Or pin in compose.yaml:
services:
ministack:
image: ministackorg/ministack:1.4.7
ports:
- "4566:4566"
Issues and PRs welcome on GitHub. Discussion on r/ministack.