Cognito identity linking, S3 versioning edges, and Pipes to Step Functions

August 26, 2026 · v1.5.2

v1.5.2 is a parity sweep across seven services. Cognito gains federated identity linking and finally reports a pool's schema, S3 completes all five checksum algorithms and answers its versioning edges the way real S3 does, EventBridge Pipes delivers DynamoDB streams to Step Functions, and input transformers, idempotent CreateStateMachine, EC2 snapshot filters, CodeBuild, Lambda response streaming and s3tables each close a real gap.

New

• Cognito — AdminLinkProviderForUser / AdminDisableProviderForUser. Both actions answered InvalidAction, so a federated identity could not be linked to a local user. Linking records the identity in the user's identities attribute (up to 5 per user, AliasExistsException when the identity is already linked) and a hosted-UI federated sign-in resolves to the linked user; disabling removes the link, and with ProviderName=Cognito it deactivates the local user's password sign-in while the profile stays. Reported by @rsimples.
• Cognito — AddCustomAttributes, and a user pool that reports its schema (SchemaAttributes). DescribeUserPool never returned the pool's attribute schema and AddCustomAttributes answered InvalidAction, so Terraform re-planned an aws_cognito_user_pool as changed right after creating it and failed the follow-up apply. A pool now carries the full standard attribute set with AWS's data types, mutability and constraints, a request's Schema entries override a standard entry field-for-field, and AddCustomAttributes adds 1-25 attributes per call with the documented errors; a Required custom attribute is refused, as real Cognito refuses it. Contributed by @jgrumboe.
• S3 — ListBuckets pagination (MaxBuckets, ContinuationToken, Prefix). Every call returned the full bucket list and ignored the paging parameters; they are now honored, with ContinuationToken alone signalling a further page, per the S3 model. Reported by @gaul.
• S3 — CRC32C checksums. A put carrying x-amz-checksum-crc32c was refused as unsupported; CRC32C is now computed in-process (table-driven, no new dependency), verified on upload (BadDigest on mismatch) and surfaced on reads with checksum mode enabled, completing all five S3 checksum algorithms. Reported by @gaul.

Fixes

• Step Functions — CreateStateMachine is idempotent. Repeating a create with the same name refused StateMachineAlreadyExists even when the request was identical, which AWS answers with the existing machine's ARN. An identical create now succeeds, only a differing one is refused, and DescribeStateMachine no longer leaks internal version-bookkeeping fields. Contributed by @bandle.
• EventBridge — an input template no longer needs quotes around a string variable. AWS adds the quotes itself when a string variable sits in a JSON value position, so the documented form {"detail": <detail>, "groupId": <groupId>} rendered a body that would not parse. A string variable in a value position is now quoted, a variable inside a string literal interpolates raw, and an object or array spliced into a string has its internal quotes stripped, as AWS does. Contributed by @ppettitau.
• EventBridge Pipes — a DynamoDB stream reaches a Step Functions target. The poller delivered to SNS and to nothing else, so a pipe targeting a state machine reported RUNNING, advanced no position and moved no records, with no error and no log line. A states target now gets one StartExecution per batch carrying the records as a JSON array, and a batch that fails to reach its target stays on the stream for the next poll to retry. Contributed by @facuparedes.
• EC2 — DescribeSnapshots evaluates Filters. Filters were ignored entirely, so every filtered call returned every snapshot in the account; the documented filter names (snapshot-id, volume-id, status, owner-id, encrypted, the tag forms, ...) now narrow the result. Contributed by @bandle.
• EC2 — two invented operations removed. DescribeInstanceMaintenanceOptions and DescribeInstanceAutoRecoveryAttribute do not exist in the EC2 API; both handlers answered invented shapes and are gone.
• S3 — CopyObject applies x-amz-acl, and UploadPartCopy honors the copy-source conditions. A canned ACL on a copy was dropped, so a copy addressed public-read landed private with no way to tell but reading the ACL back, and UploadPartCopy ignored all four x-amz-copy-source-if-* headers. A copy now permissions the destination as a put does, a copy without an ACL leaves the destination private, and both copy operations judge the source conditions the same way. Contributed by @gaul.
• S3 — the versioning edges answer the way S3 answers them. DeleteBucket deleted a bucket that still held versions or delete markers (now BucketNotEmpty); reading a delete marker by its version id answered 200-empty on GET and NoSuchVersion on HEAD (now 405 Method Not Allowed with the marker's own headers); an ACL or tag operation naming a version that never existed read back the default policy (now NoSuchVersion); and ListObjectVersions honors delimiter. Contributed by @gaul.
• S3 — the directory-bucket delete conditions are refused. x-amz-if-match-size and x-amz-if-match-last-modified-time (and the Size / LastModifiedTime members in a DeleteObjects entry) were silently ignored on a general-purpose bucket; they now answer NotImplemented, as live S3 does. Reported by @gaul.
• CodeBuild — BatchDeleteBuilds reports buildsNotDeleted as structures. An id that could not be deleted was reported as a bare string where the API models {id, statusCode}, crashing SDK parsers; it now answers the documented structure.
• Lambda — InvokeWithResponseStream returns an HTTP-level error unframed. A ResourceNotFoundException (and any other non-200) was wrapped in the eventstream envelope, which SDK parsers cannot read; the error now returns as plain JSON, and only a 200 streams.
• s3tables — the delete operations answer 204 No Content. DeleteTableBucket, DeleteNamespace and DeleteTable answered 200 {} where AWS answers an empty 204.

Upgrade

docker pull ministackorg/ministack:1.5.2
docker run -d -p 4566:4566 ministackorg/ministack:1.5.2

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.5.2
    ports:
      - "4566:4566"