Ten reported issues, closed

September 20, 2026 · v1.5.14

v1.5.14 is an issue-sweep release. Ten reported issues are fixed in it, and most of them were cases where MiniStack accepted a request and then quietly did nothing with part of it: an API Gateway usage plan that throttled nothing, a Bedrock Retrieve filter that was parsed and ignored, an AppConfig feature-flag profile served in the wrong format, an S3 notification that read back empty for anything but the SDK that wrote it. Alongside those, KMS gained the real external key-material flow, PostgreSQL instances serve TLS, and IoT job executions actually time out.

New

• KMS — imported key material. A key created with Origin=EXTERNAL stayed unusable because there was no way to supply its material. GetParametersForImport, ImportKeyMaterial and DeleteImportedKeyMaterial complete the flow: the key waits in PendingImport, all five wrapping algorithms unwrap, and ExpirationModel and ValidTo are reported. Reported by @guymahieu.
• API Gateway — REST request validators, API keys, throttling and quotas are enforced. The five RequestValidator operations are implemented, a method's requestValidatorId is applied to the body and parameters, and an API key is checked against its usage plan's rate, burst and quota. Reported by @iot-rocket.
• CloudFormation — update handlers for twelve more types. A stack update of these types re-ran the create, so the resource came back under a new id or the change was lost. Each now updates in place where its reference allows, replaces otherwise, and refuses to replace a custom-named resource. Contributed by @iot-rocket.
• RDS — PostgreSQL instances serve TLS, and IAM auth is resource-bound. A generated CA signs a server certificate for each container, so a client connecting with sslmode=verify-full completes the handshake; GET /_ministack/rds/ca.pem returns that CA. Separately, a verified IAM database token is authorized against the policy's resource, so a grant scoped to one database user stops matching another. Reported by @jayjanssen. Contributed by @Areson.
• Bedrock — Retrieve filters, and toolConfig reaches the model. vectorSearchConfiguration.filter was parsed and ignored, so every query returned the whole knowledge base; all eleven comparators plus andAll and orAll now select against a document's .metadata.json sidecar. A Converse call carrying tools was proxied without them, so the model could never answer with a tool use. Reported by @Vidminas.
• IoT — a job execution times out. timeoutConfig.inProgressTimeoutInMinutes and the device's own stepTimeoutInMinutes were stored and ignored, so an execution stayed IN_PROGRESS for ever. An execution past its timeout is now TIMED_OUT, and the device plane reports approximateSecondsBeforeTimedOut while it runs.
• Health — the IoT mTLS listener is reported. /_ministack/health carries iot_mtls, and /_ministack/ready waits for that listener, so a consumer polling readiness no longer races the MQTT port.

Changed

• IAM — wildcard matching is case-sensitive where AWS makes it case-sensitive. Resource, NotResource, StringLike, StringNotLike, ArnEquals and ArnLike compared case-insensitively, so a policy naming arn:aws:s3:::MyBucket also matched mybucket. Only Action stays case-insensitive, as on AWS.
• SQS — the default MaximumMessageSize is 1 MiB. Queues were created with AWS's old 256 KiB default, so a message between 256 KiB and 1 MiB was rejected where AWS accepts it.

Removed

• Four timing environment variables. TRANSCRIBE_JOB_RUN_SECONDS, GLUE_CRAWLER_RUN_SECONDS, MINISTACK_DDB_IMPORT_COMPLETE_AFTER_SEC and LAMBDA_STATE_TRANSITION_SECONDS paced emulator-only state transitions and had no AWS counterpart. The transitions keep their previous pacing.

Fixes

• S3 — notification configurations read back for every SDK. An omitted Id read back missing, where AWS assigns base64 of a UUID, and the request XML was echoed back verbatim, so a configuration sent with LambdaFunctionConfigurations came back empty for a client expecting the wire name CloudFunctionConfiguration — which also hid a CloudFormation-declared Lambda notification. Reported by @jin-gizmo.
• AppConfig — GetLatestConfiguration serves a feature-flag profile in retrieval-time format. The stored {flags, values, version} document was returned verbatim, so a client reading a flag found nothing at the top level. Reported by @dk-tanio.
• Bedrock AgentCore — timestamps are ISO 8601 strings everywhere. CreateAgentRuntime answered with a JSON number while ListAgentRuntimes answered with a string for the same field, so a typed SDK failed on one of the two. Reported by @ykalemi.
• EventBridge — dynamic HTTP parameters for API destinations. HttpParameters JSON paths went to the endpoint as literal $. strings. They now resolve against the original event, before input transformation. Contributed by @dmgarland.
• RDS — restarting a cluster keeps its DNS endpoint, and RDS Data reports read row counts. A restart reported the container's IP in place of the *.rds.amazonaws.com name handed out at creation, breaking connection strings and hostname-verified TLS. Separately, numberOfRecordsUpdated carried the row count for a SELECT, where AWS reports 0. Contributed by @jayjanssen.
• CloudFormation — DeletionPolicy Snapshot takes a snapshot. The policy was read and never acted on, so a resource declaring it was deleted with nothing kept, and an RDS cluster or standalone instance, which AWS defaults to Snapshot, defaulted to Delete here. Both now snapshot and then delete, on a stack delete and on an update that removes the resource.
• CloudFormation — four answers match AWS. AWS::WAFv2::WebACL returned a bare id where AWS returns name|id|scope, ExecuteChangeSet sent the shape name InvalidChangeSetStatusException as its error code, the Rules section evaluated Fn::If where a real account refuses it, and the 60 dynamic references per template quota was not enforced.
• CloudFormation — AWS::ECR::Repository keeps what the template declares, and a rolled-back replacement keeps the old resource. Scanning and encryption read back empty, policies and tags were dropped, PutImage failed and a delete left images behind. Separately, an update handler deleted the predecessor as soon as the replacement existed, so a later failure rolled back to a resource that was gone. Contributed by @iot-rocket.
• API Gateway — gateway responses and errors reach the data plane. A customized gateway response was stored and never applied, so a 401 or 403 carried none of the CORS headers a CDK stack declares. Gateway errors answered with invented statuses; a failed authorizer is now 500 AUTHORIZER_FAILURE, a missing backend 500 API_CONFIGURATION_ERROR, an unknown stage 403 Forbidden, and a MOCK integration honours its own statusCode. Contributed by @iot-rocket.
• IoT — rule SQL accepts the grammar AWS accepts, and the error action document matches. != and == were evaluated where AWS refuses both, and a nested SELECT in a WHERE clause was accepted. A failed action was reported as {action, errorMessage}, where AWS names failedAction and failedResource, with a clientId of N/A and a sourceIp.
• IoT — CreateJob validates, DescribeJob echoes, and the device plane answers what AWS answers. A schedule time with seconds, a timeout outside 1 to 10080, an oversized document and a request naming neither document nor source were all accepted. Eight stored members were never reported back, and job timestamps were fractional seconds. UpdateJobExecution with a status a device cannot set now answers InvalidStateTransitionException 409, and an unknown executionNumber ResourceNotFoundException 404.
• Cognito — the OIDC discovery document follows the gateway's scheme. Every endpoint in it was http even with USE_SSL=1, so the document contradicted its own https issuer and a discovery client refused it. Reported by @epcap90.
• Lambda — an AWS-published extension layer resolves. A template referencing LambdaInsightsExtension, the Parameters and Secrets, AppConfig or OpenTelemetry extensions or AWSSDKPandas could not deploy, because the publisher account is unknown offline. It resolves by layer name with CodeSize 0, so the extension does not run.
• Four smaller ones. Auto Scaling returned the shape name AlreadyExistsFault instead of the wire code AlreadyExists; a bare -e NAME EC2 docker flag was passed as an empty string instead of taking the host value; an unknown S3 Control /v20180820 path answered generically instead of InvalidURI; and Signer kept every clientRequestToken for ever.

Upgrade

docker pull ministackorg/ministack:1.5.14
docker run -d -p 4566:4566 ministackorg/ministack:1.5.14

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.5.14
    ports:
      - "4566:4566"