Every service loads on its own

September 17, 2026 · v1.5.13

v1.5.13 is mostly about things that were quietly costing you: the first request to any service pulled in the whole CloudFormation package, and through its provisioners AppSync and graphql, so a stack you never declared was paying for itself on every cold start. ImportTable created the table, said COMPLETED and never opened the source objects. Under AUTH=true a Secrets Manager grant written by the CDK matched nothing, because the resource was built from the name in the request instead of the stored ARN. Alongside those, the AWS::LanguageExtensions transform arrives.

New

• CloudFormation — the AWS::LanguageExtensions transform. A template declaring it was provisioned unexpanded, so an Fn::ForEach left the stack in CREATE_IN_PROGRESS for good and an Fn::ToJsonString reached SSM as a Python dict. The transform now runs between AWS::Include and SAM: Fn::ForEach over literal, CommaDelimitedList and intrinsic collections, nested and inside Properties, plus Fn::Length and Fn::ToJsonString. Contributed by @iot-rocket.
• RDS — IAM database authentication tokens are verified. A helper validates an SDK-generated token against the endpoint, port, database username, signing scope, lifetime and signature. Nothing calls it yet; database login itself is a later stage. Contributed by @Areson.

Changed

• Persistence — every saved snapshot is restored through the registry. A service restored its own state as a side effect of being imported, so the boot path carried a hand-maintained list of eager imports to cover the modules the router never reached. One registry-driven restore loop replaces it. No user-visible change. Contributed by @jgrumboe.

Fixes

• Router — the first request to any service no longer loads CloudFormation. The WaitCondition signal handler imported cloudformation.wait_conditions above the path check, so every first request pulled in the whole package and, through its provisioners, AppSync and graphql; the first /_ministack/reset ran appsync.reset() with it. The import now sits behind the path match, and a guard keeps it there. Reported by @ThailerL.
• DynamoDB — ImportTable reads the S3 source. The import created the table, reported COMPLETED and imported nothing: the source objects were never opened. CSV and DYNAMODB_JSON, GZIP or uncompressed, are now read from the prefix and written into the table, with per-item errors in the /aws-dynamodb/imports log group. A missing bucket or prefix fails the import and leaves no table behind. Contributed by @gakuto-cw21.
• IAM — a Secrets Manager request is authorized against the stored secret ARN. The resource was built from the name in the request, secret:<name>, while AWS evaluates the stored ARN with the six random characters minted at CreateSecret. The grant shape the CDK writes for a secret looked up by name matched nothing under AUTH=true. Contributed by @iot-rocket.
• IAM — a group policy document is validated, and an AWS::IAM::Policy naming a missing entity fails. PutGroupPolicy stored a malformed document; all three inline handlers now answer NoSuchEntity before MalformedPolicyDocument. An AWS::IAM::Policy skipped a Role, User or Group that was not there and reported CREATE_COMPLETE. Contributed by @iot-rocket.
• IAM — three calls are authorized against the action and resource AWS uses. A Lambda Function URL invoke is checked against its function ARN, alias qualifier included, and supplies lambda:FunctionUrlAuthType, so the policy grantInvokeUrl writes matches. The WebSocket @connections API asks for execute-api:ManageConnections. iot-jobs-data operations are authorized under iotjobsdata:, except StartCommandExecution. Contributed by @iot-rocket.
• Lambda — a layer shared through AddLayerVersionPermission attaches. Every layer ARN from another account was refused before the stored policy was read. Attachment, from the API and from a CloudFormation function, and GetLayerVersionByArn now evaluate it for account, root, public and organization grants, and an attached function keeps the content after the grant is revoked. Contributed by @iot-rocket.

Upgrade

docker pull ministackorg/ministack:1.5.13
docker run -d -p 4566:4566 ministackorg/ministack:1.5.13

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.5.13
    ports:
      - "4566:4566"