August 25, 2026 · v1.5.1
v1.5.1 rounds out the 1.5 line. RDS gains the full RDS Proxy control plane, SNS platform applications can finally be read back and updated, Step Functions adds the last two missing intrinsics and the documented aws-sdk:cloudwatchlogs integration, and the slim Docker image now ships the MySQL IAM auth plugins. On the fix side: every supplied S3 checksum is actually verified, least-privilege IAM policies work for JSON-protocol services and kms:Decrypt, and Cognito, S3 presigned uploads, EventBridge, Glue, CloudFormation, IoT and RDS each close a real gap.
GetPlatformApplicationAttributes / SetPlatformApplicationAttributes. Both answered 400 InvalidAction, so terraform plan on an aws_sns_platform_application failed at refresh. Get returns the attribute map, Set merges the supplied entries, with InvalidParameter (400) and NotFound (404) for the documented failure cases; CreatePlatformApplication also seeds Enabled=true, as AWS reports for a new application. Contributed by @jgrumboe.States.StringSplit and States.Hash. Both raised States.Runtime: Unsupported intrinsic function, and splitting $$.Execution.Id on : is how a machine recovers its own region and account id. StringSplit treats every character of its second argument as a delimiter and keeps no empty member; Hash computes the five published algorithms as lowercase hex, shares the base64 intrinsics' 10,000-character cap, and refuses any other algorithm. Contributed by @bandle.CreateDBProxy and the twelve other proxy operations answered InvalidAction, so an aws_db_proxy definition could not be applied at all. Proxies, endpoints, the default target group and registered targets now create, describe, modify and delete with the documented shapes, defaults, constraints and faults; creating a proxy also creates its default endpoint and default target group, as AWS does. Metadata only — nothing listens on the proxy hostname. Reported by @jmreicha.EC2_DOCKER_FLAGS). An image that boots an operating system (systemd as PID 1) needs container options the fixed launch arguments cannot express. EC2_DOCKER_FLAGS takes a docker-CLI-style string (--privileged, --cap-add, -e, -v, ...) applied to every instance container; unset, nothing changes. Contributed by @iot-rocket.-full flavor, so on the slim image Aurora MySQL IAM authentication silently disabled itself. The slim build now copies the plugin tree from the published full image, pinned to the release's digest so both flavors carry the same tree. Contributed by @Areson.AUTH=true). SQS, ACM, SSM and CloudWatch parameters were read from the query form only, so for current SDKs the resource fell back to * and every queue-, certificate-, parameter- or alarm-scoped statement denied. The request body is now read too, and SQS also resolves a queue addressed by path. Reported by @rsimples.kms:Decrypt resolves the key from the ciphertext (AUTH=true). Decrypt and ReEncrypt carry no KeyId for a symmetric key, so the resource fell back to * and a policy naming the key allowed Encrypt but denied Decrypt. The key id is now recovered from the ciphertext blob. Reported by @rsimples.CreateFunction with an unresolvable role answers 400, not 500 (AUTH=true). The role check's error was swallowed inside config building, so the client got 500 InternalError and a half-created record was left behind; the role is now validated before anything is stored, answering 400 InvalidParameterValueException. Reported by @rsimples.UsernameAttributes = ["email"], group membership stored the caller-supplied alias rather than the resolved Username, so ListUsersInGroup dropped the member and AdminRemoveUserFromGroup never matched it; and AdminDeleteUser deleted by the alias, raised KeyError, answered 500 and left the user alive. Both now key on the resolved Username. Contributed by @Lukasdoe.x-amz-* headers it was signed with. SigV4 lets a presigned URL hoist the operation's x-amz-* headers into the query string, and real S3 applies them as the headers they stand for; MiniStack only read headers, so a presigned PutObject stored the object without its metadata. Hoisted params are now folded back in before routing. Contributed by @dennmart.x-amz-checksum-* value was only checked when the request also named x-amz-sdk-checksum-algorithm, so a mismatched value was stored unread and echoed on later reads as though verified, and a checksum sent as an aws-chunked trailer never arrived at all. Every supplied value is now recomputed (BadDigest on mismatch) and trailing headers are read. Contributed by @gaul.aws-sdk:cloudwatchlogs integration routes. Step Functions names CloudWatch Logs by its SDK service id, so the documented arn:aws:states:::aws-sdk:cloudwatchlogs:createLogGroup failed States.Runtime before dispatch. The documented name now dispatches, takes PascalCase Parameters, and surfaces errors as CloudWatchLogs.*. Contributed by @bandle.boto3.client("s3") in a job script escaped to real AWS and failed InvalidAccessKeyId. The container now carries AWS_ENDPOINT_URL, and a bootstrap covers the Glue 4.0 image's older botocore.Fn::Sub honors the ${!Literal} escape. ${!Literal} rendered as !Literal and registered a false dependency; an AWS::IoT::Policy pinned to ${!iot:Connection.Thing.ThingName} deployed with a document matching nothing. It now renders as the literal ${Literal}. Contributed by @maximoosemine.., so {"detail.name": [...]} and the nested spelling are the same rule on AWS, but the 1.4 matcher read a dotted key as one literal segment and such a rule silently matched nothing. Pattern keys are now split on . when the compiler extends the path. Contributed by @prandogabriel.CreateTopicRule (AUTH=true). The role-check error was discarded and the API answered 200 {} while storing nothing; it now answers 400 InvalidRequestException (Unable to assume role: {arn}) as real IoT does, and the CloudFormation provisioner fails the resource. Contributed by @iot-rocket.DescribeDBEngineVersions treated EngineVersion=16 as an exact version and returned nothing; major-only selectors now return every advertised minor, and DefaultOnly=true narrows to AWS's default minor for that major. Contributed by @jayjanssen.docker pull ministackorg/ministack:1.5.1 docker run -d -p 4566:4566 ministackorg/ministack:1.5.1
Or pin in compose.yaml:
services:
ministack:
image: ministackorg/ministack:1.5.1
ports:
- "4566:4566"
Issues and PRs welcome on GitHub. Discussion on r/ministack.