Organizations for Terraform, and S3 history that survives a restart

September 23, 2026 · v1.5.16

v1.5.16 fills in AWS Organizations for Terraform, with member accounts, service control policies and their attachments, and closes a persistence gap in S3: with S3_PERSIST=1, a versioned object's history now lives on disk with its bytes, so a delete marker, every earlier version and each version's tags and ACL come back after a restart instead of the deleted object.

New

• Organizations — member accounts, service control policies and attachments. CreateAccount, DescribeCreateAccountStatus, MoveAccount, CloseAccount, CreatePolicy, DescribePolicy, UpdatePolicy, DeletePolicy, ListPolicies, AttachPolicy, DetachPolicy, ListPoliciesForTarget, ListTargetsForPolicy, EnablePolicyType and DisablePolicyType, so aws_organizations_account, aws_organizations_policy and aws_organizations_policy_attachment apply. CreateAccount answers with a CreateAccountStatus whose id the provider reads back through DescribeCreateAccountStatus, as on AWS. A root carries SERVICE_CONTROL_POLICY enabled and the AWS-managed p-FullAWSAccess, attaching a policy whose type the root has disabled is PolicyTypeNotEnabledException, and deleting an attached policy is PolicyInUseException. Reported by @rv0lt.
• SNS — direct-to-phone publishes can be read back. A Publish with a PhoneNumber and no TopicArn is recorded and served at GET /_ministack/sns/sms-messages, filterable by account, region and phoneNumber. Contributed by @himangshuj.
• Lambda MicroVMs — image lifecycle. ListMicrovmImages, GetMicrovmImage, GetMicrovmImageVersion and UpdateMicrovmImage. Contributed by @edersonbrilhante.

Fixes

• S3 — a versioned object keeps its history across a restart. With S3_PERSIST=1 a delete marker was lost on restart, so a deleted object came back. Every version and delete marker now persists with the object on disk, each version keeps its own bytes, tags and ACL, and object tags and ACLs survive a restart for unversioned objects too. Contributed by @pauloRohling.
• ECS — service deployments track task health and roll back. A completed deployment drains the previous task definition's tasks, deploymentCircuitBreaker fails a deployment whose tasks keep stopping and, with rollback, restores the previous one, and replacement stays within maximumPercent while keeping minimumHealthyPercent of desiredCount running. Contributed by @jgrumboe.
• CloudFormation — change sets report which property edits replace a resource. Every property edit answered Replacement: Conditional and RequiresRecreation: Conditionally. For 21 resource types a create-only property is now Always with Replacement: True, a conditionally create-only one stays Conditionally, and every other property is Never. Contributed by @iot-rocket.
• EC2 — Elastic IP tags and IPv6 network ACL entries survive a read. DescribeAddresses omitted EIP tags, so Terraform repeatedly planned tags and tags_all; network ACL entries always stored and returned an IPv4 CIDR, so an IPv6 rule was read back as a changed IPv4 rule on every plan. Tags and Ipv6CidrBlock now round-trip through the EC2 API, and ReleaseAddress drops the address's tags. Contributed by @edersonbrilhante.
• Bedrock — a proxied tool-call turn reports its real token usage. With MINISTACK_BEDROCK_PROXY_URL set, Converse and ConverseStream estimated usage from the reply text, so a turn that returned only a toolUse block reported outputTokens: 0, and inputTokens ignored the toolConfig. Usage now comes from the proxy's own prompt_tokens and completion_tokens, with the estimate kept for a proxy that sends none. Reported by @Vidminas.

Internal

• CI — one Docker preview comment per PR. The preview-image workflow updates a single comment instead of posting one per push. Contributed by @jgrumboe.
• Tests. Split test files folded into their service's file.

Upgrade

docker pull ministackorg/ministack:1.5.16
docker run -d -p 4566:4566 ministackorg/ministack:1.5.16

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.5.16
    ports:
      - "4566:4566"