CloudFormation stack updates stop destroying resources

September 13, 2026 · v1.5.11

v1.5.11 is a CloudFormation release. Eighteen more resource types got a real update handler, so a stack update no longer falls through to the create handler and mints a new physical id for a resource that only changed a property — a distribution, an HTTP API, a queue policy or an alias keeps its identity and its children. UpdateReplacePolicy: Retain now holds for every handler-side replacement, not just the ones on the shared helper. Alongside that, a presigned S3 URL is verified against the credentials that signed it, an SDK call from a Lambda runs under the function's execution role, and five reads that users reported come back the way AWS returns them.

New

• CloudFormation — ValidateTemplate reports capabilities and transforms. It answered Description and Parameters only, so a caller checking a template before a deploy could not see that it needs CAPABILITY_IAM or that it declares a transform. Contributed by @iot-rocket.
• CloudFormation — a stack and a change set report their capabilities. DescribeStacks and DescribeChangeSet left the Capabilities member out, so a client could not see what a deploy had acknowledged. Contributed by @iot-rocket.

Fixes

• CloudFormation — eighteen more types update in place. The five CloudFront policy, OAC and function types, the distribution, the four HTTP API types, the two policy types, an SNS subscription, a Lambda alias, a log subscription filter, an IAM instance profile and the two Cognito types had create handlers only. A stack update fell through to the create: a new Id and DomainName on a distribution with the old one deleted, a new ApiId with every route and integration re-created under it, a queue or topic left with no policy at all after the cleanup delete stripped what the create had just written. Each type now updates through the service's own call and keeps its id. Contributed by @iot-rocket.
• CloudFormation — UpdateReplacePolicy: Retain holds everywhere. 24 update handlers that replace a resource themselves deleted the predecessor inline, so a template that retains it lost the resource while the stack still recorded DELETE_SKIPPED. Every inline delete now goes through one helper that reads the policy, and a resource inside a nested stack reads its own policy instead of whatever the parent left behind. Contributed by @iot-rocket.
• S3 — a presigned URL is verified against the credentials that signed it. The signature was recomputed with the server's own secret, so a URL signed with an IAM user's or an STS session's key verified against the wrong one, and a deactivated key or an expired session was accepted. Contributed by @Areson.
• S3 — a presigned upload is no longer rejected for the checksum in its query string. Current SDKs sign x-amz-checksum-crc32 into every presigned PutObject, computed over the empty body, and MiniStack verified it against the real body: a stock getSignedUrl upload failed with 400 BadDigest. Contributed by @bognari.
• S3 — the s3:TestEvent no longer reaches Lambda targets. AWS sends the test event to SQS and SNS only and verifies a Lambda destination through its function permissions. The payload has no Records array, so every S3-triggered function raised on it and the async path dropped it in the function's DLQ. Contributed by @ppettitau.
• Lambda — an SDK call from a function runs under its execution role. Under AUTH=true every runtime received account-root credentials, so a call from a handler bypassed the role the function declares and a policy that should have denied it did nothing. Contributed by @adamkeener.
• Lambda — durable invocations run on the warm pool, and two executions no longer share a callback. Durable Python and Node.js invocations went to the one-shot executor and timed out on a loaded machine; and the CallbackId was the operation id, so two concurrent executions of one function registered the same id and an answer sent for one completed the other. Contributed by @iot-rocket. Reported by @Nhollas.
• ECS — RunTask returns before the image is pulled. The call blocked for the whole pull. A task is registered and returned immediately and walks PENDING → ACTIVATING → RUNNING. Contributed by @po-luka-miletic.
• Reads that users reported. A CloudWatch log group reports logGroupClass and kmsKeyId, a SecureString parameter reports its KeyId, a security group's IPv6 and prefix-list rules survive DescribeSecurityGroups, and a launch template keeps its metadata options and shutdown behaviour — four reads that made Terraform plan the same change on every run. Reported by @edersonbrilhante. Fn::GetAtt on a user pool client's ClientSecret resolves instead of rolling the stack back. Reported by @JoshuaSmeda.

Upgrade

docker pull ministackorg/ministack:1.5.11
docker run -d -p 4566:4566 ministackorg/ministack:1.5.11

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.5.11
    ports:
      - "4566:4566"