Certificates that look like AWS's

September 22, 2026 · v1.5.15

v1.5.15 is a small release with one theme running through it: things MiniStack stored and then ignored. An ECS task definition's awslogs configuration went nowhere, a KMS key created with Origin=EXTERNAL refused every spec but the symmetric one, an OpenAPI body's securityDefinitions were discarded on import, and the RDS server certificate could not even be generated once an endpoint outgrew the X.509 common-name limit.

New

• ECS — awslogs container output reaches CloudWatch Logs. A task definition's awslogs configuration was stored and ignored, so a Docker-backed RunTask container's output went nowhere. Lines now reach the configured group, on a stream named <prefix>/<container>/<task-id> or after the container id without a prefix, in awslogs-region. Contributed by @rszabo50.
• RDS — an internal broker answers IAM database authentication. POST /_ministack/rds/iam-auth verifies a token against a process-local capability bound to one endpoint, so the MySQL plugin can decide a login. Capabilities are never persisted or issued over HTTP, and nothing calls the endpoint yet. Contributed by @Areson.

Fixes

• RDS — the server certificate carries the endpoint AWS puts in it. Certificate generation raised ValueError once an endpoint passed the X.509 64-byte common-name bound, so a database with a long identifier could not start. The common name is now the advertised endpoint at its full length, the subject carries OU=RDS, O=Amazon.com, L=Seattle, ST=Washington, C=US, and the signing CA is named Amazon RDS <region> Root CA RSA2048 G1, matching a certificate captured from a real instance. Contributed by @jayjanssen.
• KMS — imported key material for HMAC and asymmetric keys. CreateKey with Origin=EXTERNAL refused every spec but SYMMETRIC_DEFAULT, where AWS supports imported material for symmetric encryption, HMAC and asymmetric keys, ML-DSA excepted. HMAC material is the raw bytes of the spec's length and asymmetric material is the private key alone, DER-encoded PKCS#8; material that does not match the key's KeySpec answers IncorrectKeyMaterialException, and GetPublicKey on a key still awaiting material answers KMSInvalidStateException. Reported by @guymahieu.
• API Gateway — an OpenAPI body's securityDefinitions reach the methods. The import discarded security outright, so a SAM API declaring a Cognito authorizer created none and every method imported as authorizationType: NONE, serving anonymous callers where AWS answers 401. Each scheme carrying x-amazon-apigateway-authorizer now becomes an authorizer, and an operation's security sets the method's authorizationType, authorizerId and authorizationScopes. Contributed by @maximoosemine.
• CloudFormation — AWS::ApiGateway::Stage method settings reach the stage as a map. The template's MethodSettings list was stored verbatim, so the throttling lookup added in 1.5.14 raised on it and every request to a CloudFormation- or SAM-deployed API answered 500. The list is now keyed "<resourcePath>/<httpMethod>", "*/*" for the stage-wide entry. Contributed by @maximoosemine.
• DynamoDB — a table restored outside the current scope keeps working. Startup restore walked the account-scoped store through values(), which filters to the request's scope, so another tenant's tables kept the plain dict JSON returns and their first UpdateItem raised KeyError. Contributed by @ihmpavel.
• Lambda MicroVMs — requests reach the MicroVM surface. The AWS CLI signs /2025-09-09/microvms and /2025-09-09/microvm-images with credential scope lambda, so Lambda's function router read the versioned path as a function name. The path now selects MicroVMs first. Contributed by @edersonbrilhante.
• IoT — the mTLS broker certificate is issued for the endpoint it serves. Its common name was Ministack IoT Broker and its SANs covered only localhost and the host's addresses, so a client verifying the ATS endpoint hostname refused the handshake. It now carries *.iot.<region>.<host> as common name and first SAN.

Internal

• CI — control-plane and data-plane tests run in separate lanes. Live-container tests shared the lane with everything else, so a Docker failure looked like a service failure. They now carry a data_plane marker and run on their own isolated network, while the control-plane lane runs with no daemon reachable. No user-visible behavior changes. Contributed by @jgrumboe.

Upgrade

docker pull ministackorg/ministack:1.5.15
docker run -d -p 4566:4566 ministackorg/ministack:1.5.15

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.5.15
    ports:
      - "4566:4566"