Managed Service for Apache Flink, S3 Access Points and Object Lambda, per-version Object Lock and KMS signing fixes

October 17, 2026 · v1.5.29

v1.5.29 adds Managed Service for Apache Flink: applications, snapshots and CloudFormation, and with Docker the job itself runs in the official Flink image. S3 gains Access Points and Object Lambda, Object Lock retention and legal holds now belong to a single object version, and browser POST uploads enforce their policy. KMS signs RSA-PSS with a digest-length salt, honours the RSA encryption algorithm you name, and refuses bad signing input with the errors AWS returns. CloudWatch Logs reads events in order across streams and pages, Lambda honours RevisionId, and Cognito refuses unusable client credentials scopes.

New

• Managed Service for Apache Flink — control plane. kinesisanalyticsv2 applications for the FLINK-* runtimes: create, describe, update and delete, start and stop with the model's status transitions, snapshots, CloudWatch logging options and tags, per account and region. Updates bump ApplicationVersionId and the ConditionalToken, and a stale one returns ConcurrentModificationException. CloudFormation creates, updates and deletes AWS::KinesisAnalyticsV2::Application, AWS::KinesisAnalyticsV2::ApplicationCloudWatchLoggingOption and AWS::Logs::LogStream, so a CDK Flink stack deploys. Contributed by @Jolley71717.
• Managed Service for Apache Flink — job execution. with Docker available, starting a FLINK-1_19 or FLINK-1_20 application runs its jar from MiniStack S3 in the official Apache Flink image (1.19.1 or 1.20.5, Java 11) with a JobManager and a TaskManager, its runtime properties at /etc/flink/application_properties.json, its configured parallelism and checkpointing, and its AWS calls pointed at MiniStack in the application's account. Snapshots are Flink savepoints, restores resume the job's state, and a job that fails to start returns the application to READY. Jars in /opt/ministack/flink-lib (for example a mounted aws-kinesisanalytics-runtime) are added to every cluster. Without Docker the control plane behaves as before. Contributed by @Jolley71717.
• S3 Access Points. S3 Control CreateAccessPoint, GetAccessPoint, ListAccessPoints, DeleteAccessPoint and Put/Get/DeleteAccessPointPolicy. The bucket must be in the request's region, names are unique per account and region, and errors follow AWS (AccessPointAlreadyOwnedByYou, NoSuchAccessPoint). Requests through an access point ARN (<name>-<account>.<host>) or its -s3alias alias reach the bucket, including as a CopyObject source; signing for another region gets the bucket-region redirect with the access point's region. DeleteBucket refuses a bucket with access points. CloudFormation provisions AWS::S3::AccessPoint, and under AUTH=true each operation needs its s3: action. Contributed by @fabio-andre-rodrigues.
• S3 Object Lambda. S3 Control Create/Get/List/DeleteAccessPointForObjectLambda, Get/PutAccessPointConfigurationForObjectLambda and the policy operations, with the supporting access point and Lambda in the same account and region. GetObject through an Object Lambda ARN or --ol-s3 alias invokes the Lambda with the documented getObjectContext (a presigned inputS3Url through the supporting access point, outputRoute, outputToken) and returns what it writes with WriteGetObjectResponse. HeadObject, ListObjects and ListObjectsV2 transformations return the Lambda's JSON result; operations without a transformation pass through; Range and partNumber need AllowedFeatures; Lambda failures map to LambdaRuntimeError, LambdaResponseNotReceived, LambdaTimeout and LambdaNotFound. CloudFormation provisions AWS::S3ObjectLambda::AccessPoint and AccessPointPolicy. AWS no longer onboards new Object Lambda customers, so the data plane follows the S3 user guide. Contributed by @fabio-andre-rodrigues.
• Lambda — AWS_DISABLE_HOST_PREFIX_INJECTION=true by default. Lambda environments set it unless the function does, so boto3 in a handler reaches WriteGetObjectResponse without the <route>.<host> prefix, which doesn't resolve locally. SDKs that ignore the variable need their host-prefix injection turned off in client config. Contributed by @fabio-andre-rodrigues.

Fixes

• Cognito / API Gateway — OAuth scope refusals. a client credentials grant that named a scope the client lacks, or one that doesn't exist, dropped it and issued a token; /oauth2/token now refuses the whole request with 400 invalid_grant or invalid_scope, and a REST API method whose authorization scopes match none in the access token answers 401 Unauthorized (the UNAUTHORIZED gateway response) instead of 403. Contributed by @gakuto-cw21.
• S3 — browser POST policies are enforced. a form upload was written whatever its policy said; an expired policy, a field that fails a condition or a field the policy doesn't cover now answers 403 AccessDenied (Invalid according to Policy: …), and under AUTH=true the SigV4 or SigV2 signature and the signer's s3:PutObject permission are checked. Contributed by @kinoh.
• CloudWatch Logs — event order across streams and pages. FilterLogEvents stopped at limit before sorting across streams, so a newer event could displace an older match; events now merge across streams by timestamp, then ingestion time, and searchedLogStreams is empty, as on AWS. GetLogEvents excludes events at endTime, and its tokens no longer repeat or skip events when late events arrive. Contributed by @kinoh.
• Lambda — RevisionId on updates. UpdateFunctionCode, UpdateFunctionConfiguration and UpdateAlias ignored RevisionId; a stale one now answers 412 PreconditionFailedException before anything changes. Contributed by @kinoh.
• SQS — an empty policy removes it. SetQueueAttributes with an empty Policy or RedriveAllowPolicy stored the empty string, and an empty RedrivePolicy was refused; each now removes the attribute, as Terraform's policy resources expect. Contributed by @kinoh.
• AppSync Events — event is a string. subscribers' data messages carried event as a one-element array; it is now the JSON-encoded string, as AWS sends it. Contributed by @edbramwell.
• S3 — Object Lock is per version. retention and legal holds were stored per key, so a lock on one version blocked permanent deletes of the key's other versions; they now belong to the version they were set on, GetObjectRetention, PutObjectRetention and the legal-hold calls take versionId, and a DeleteObject or DeleteObjects without a VersionId on a locked key adds a delete marker instead of answering 403. Reported by @bettiah.
• S3 — Object Lock headers need an Object Lock bucket. PutObject, CopyObject, CreateMultipartUpload and browser POST uploads with x-amz-object-lock-* headers on a bucket created without Object Lock applied the lock; they now answer 400 InvalidRequest Bucket is missing ObjectLockConfiguration. Reported by @bettiah.
• KMS — ScheduleKeyDeletion window. a PendingWindowInDays outside 7–30 was accepted; it now answers ValidationException PendingWindowInDays must be between 7 and 30. Reported by @bettiah.
• KMS — RSASSA-PSS salt. signatures used a maximum-length salt; they now use a salt as long as the digest, as AWS does, and Verify expects the same. Reported by @bettiah.
• KMS — RSA encryption algorithms. Encrypt and Decrypt used OAEP SHA-256 whatever EncryptionAlgorithm named; they now use RSAES_OAEP_SHA_1 or RSAES_OAEP_SHA_256 as named, so a mismatched Decrypt, or one without EncryptionAlgorithm, answers InvalidCiphertextException, and an Encrypt with an algorithm the key doesn't support answers InvalidKeyUsageException. Reported by @bettiah.
• KMS — Sign and Verify input checks. a digest of the wrong length or an algorithm the key spec doesn't support crashed with a 500; they now answer 400 ValidationException (Digest is invalid length for algorithm …) and InvalidKeyUsageException, and an unknown algorithm name answers the enum ValidationException. Reported by @bettiah.
• CloudFormation — AWS::S3::MultiRegionAccessPoint Ref when the access point exists. a create that found an existing Multi-Region Access Point of the same name returned its alias as the physical id; Ref now returns the name in that case too.

Upgrade

docker pull ministackorg/ministack:1.5.29
docker run -d -p 4566:4566 ministackorg/ministack:1.5.29

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.5.29
    ports:
      - "4566:4566"