AWS IoT and AppSync Events region-isolated, plus S3 Tables, Step Functions, and CloudFormation fixes

July 28, 2026 · v1.4.8

v1.4.8 continues the multi-region push — AWS IoT (control plane and MQTT broker) and AppSync Events now isolate state by account and region. It also lands parity fixes for S3 Tables Iceberg commits and CloudFormation schema wiring, Step Functions JSONPath array indexing, and a crash on aws-cdk-local cross-stack deploys.

Multi-region — AWS IoT and AppSync Events

• AWS IoT — account+region-scoped state. The control plane (Things, thing types, thing groups, certificates, policies, topic rules, device shadows) and the MQTT broker (clients, persistent sessions, subscriptions, retained messages) were account-scoped, so same-name resources, subscriptions, and retained messages collided or leaked across regions. All of it now scopes by account and region; the request region threads through the HTTP and WebSocket MQTT paths, and exact account/region scope is required before topic-wildcard matching so signer-controlled values can't cross regions. Persisted state carries a versioned regional schema (on-disk format v3) that an older binary refuses rather than misreads; legacy resources migrate by ARN region and retained messages migrate to the boot region. Contributed by @Areson.
• AppSync Events — account+region-scoped state. Event APIs, channel namespaces, and API keys were account-scoped and collided across regions. They now scope by account and region, with the WebSocket and HTTP data planes resolving an API's creation region while preserving SigV4 credential-region enforcement, advertised-host validation, and per-API fan-out isolation. Persisted state carries the versioned regional schema (on-disk format v3) an older binary refuses; legacy child records migrate with their parent API. Contributed by @Areson.

Fixes

• Step Functions — context object paths now resolve array indexes. JSONPath references such as $$.Map.Item.Value.values[0].name returned null because context paths used a separate dotted-key-only resolver. Context paths now retain their distinct $$. root while sharing the standard path traversal, so indexed references work in ItemSelector fields and intrinsic-function arguments. Contributed by @felixp-square.
• S3 Tables — Iceberg REST commits duplicated schema/spec/sort-order entries, crashing Spark on load. The commit handler appended unconditionally on add-schema/add-spec/add-sort-order, but Spark re-declares its current unchanged schema, partition spec, and sort order on every write, so a second commit produced a duplicate id and the next table load failed building Iceberg's id-keyed maps (Multiple entries with same key). These updates are now idempotent by id, matching the invariant Iceberg's own TableMetadata builder enforces. Contributed by @squirmy.
• S3 Tables — AWS::S3Tables::Table CloudFormation ignored the declared schema. The provisioner hardcoded an empty Iceberg schema and never read IcebergMetadata.IcebergSchema.SchemaFieldList, so every table created through CloudFormation had zero columns regardless of the template, and downstream consumers failed (a Firehose Iceberg-destination delivery errored with does not have a column with name …). The provisioner now parses SchemaFieldList (Name/Type/Required) into the table's Iceberg schema, the same way the CreateTable API path does. Contributed by @ryan-bennett.
• CloudFormation — cross-stack CDK deploys crashed with 'dict' object has no attribute 'startswith'. aws-cdk-local rewrites a CDK cross-stack reference into the non-AWS Fn::GetStackOutput intrinsic instead of Fn::ImportValue, and the engine never resolved it, so the unresolved dict reached a provisioner (for example an AWS::Lambda::Permission FunctionName) and rolled the stack back. The engine now resolves Fn::GetStackOutput to the named output of the referenced already-deployed stack, so cdklocal deploy --all across dependent stacks works. Reported by @jacsonrsasse.

Upgrade

docker pull ministackorg/ministack:1.4.8
docker run -d -p 4566:4566 ministackorg/ministack:1.4.8

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.4.8
    ports:
      - "4566:4566"