JSONata for Step Functions, the IoT device plane, and S3 replication

August 28, 2026 · v1.5.3

v1.5.3 is the biggest parity wave since 1.5.0. Step Functions speaks the JSONata query language, IoT gains the jobs device contract over MQTT and the provisioning-template control plane, CloudFormation updates resources in place and fails honestly when a delete cannot happen, S3 replication actually delivers, and the ECS + ALB pair a Terraform module produces — service, target group, listener rule — now routes traffic end to end.

New

• Step Functions — the JSONata query language. QueryLanguage: JSONata definitions evaluate through a full JSONata engine: $states and workflow variables, the six Step Functions functions, causes leading with the JSONata error code (T2010: ...), malformed expressions refused at CreateStateMachine with INVALID_JSONATA_EXPRESSION naming the field's path, AWS's D3110/D1004 refusals, and the 1-second evaluation timeout. $eval is absent, as on AWS. Reported by @facuparedes.
• IoT Core — jobs delivered over MQTT. The reserved $aws/things/<t>/jobs/# request topics answer on their accepted/rejected topics from the same store the HTTP plane uses — jobDocument as a JSON object, string ErrorCode rejections with the execution's state on conflicts, notify on pending-set changes and notify-next only when the queue front changes. Contributed by @iot-rocket.
• IoT Core — provisioning templates, and AWS::IoT::ProvisioningTemplate. The five template operations and the CloudFormation type now work with the real service's wire shapes; storage + CRUD only, the fleet-provisioning MQTT workflow is not implemented. Contributed by @iot-rocket.
• API Gateway — registered custom domains route the data plane. A request addressed by a registered domain resolves through its base-path mappings before any host guessing — longest base path wins, "(none)" is the root mapping — instead of falling through to S3 (or to IoT, when the domain contained iot.). Contributed by @iot-rocket.
• CloudFormation — in-place update handlers. A stack update re-ran create for 106 of 132 types, wiping Lambda versions, DynamoDB items, SQS messages and IAM attachments; eleven high-traffic types now update in place through their service's own APIs, replacing only for genuinely create-only properties. Contributed by @iot-rocket.
• S3 — replication delivers, with x-amz-replication-status. A write matching an Enabled rule lands in the destination bucket with the source's metadata and tags; the source answers COMPLETED (or FAILED) and the replica REPLICA, on current and version-addressed reads alike. Reported by @cringdahl.

Fixes

• CloudFormation — a resource that cannot be deleted fails the operation. DeleteStack lands DELETE_FAILED with the failed resources retained for a retry and exports kept; a failed rollback lands ROLLBACK_FAILED/UPDATE_ROLLBACK_FAILED. AWS::Lambda::Version's Ref now returns the qualified version ARN, as on AWS. Contributed by @iot-rocket.
• IoT Core — an HTTP shadow write publishes the reserved-topic notifications. A topic rule on .../shadow/update/accepted now fires for REST-API updates too; the shared emission code also fixed the documents envelope on both transports. Contributed by @iot-rocket.
• IoT Core — device-plane job timestamps were milliseconds, 1000x off. Every iot-jobs-data stamp is now whole epoch seconds, as the API reference words them. Contributed by @iot-rocket.
• Step Functions — execution status changes are published to EventBridge. Standard executions emit aws.states / Step Functions Execution Status Change to the default bus on start and completion with the documented detail fields, so rules and event-driven consumers finally fire. Reported by @moonyseven.
• ECS — a service's tasks register in its target groups. A loadBalancers block now reconciles the group from the service's running tasks (awsvpc tasks carry attachments[].details[privateIPv4Address]), withdrawing only its own registrations, as real ECS does. Contributed by @jbschooley.
• ECS — an awsvpc task no longer publishes host ports. Two tasks sharing a container port no longer collide with a Docker bind error that cannot happen on Fargate. Contributed by @jbschooley.
• ELBv2 — a rule condition sent as a typed config is read. Terraform's PathPatternConfig/HostHeaderConfig/HttpRequestMethodConfig/SourceIpConfig shapes parse, DescribeRules echoes the typed config alongside Values, and the matcher recognizes http-request-method. Contributed by @jbschooley.

Upgrade

docker pull ministackorg/ministack:1.5.3
docker run -d -p 4566:4566 ministackorg/ministack:1.5.3

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.5.3
    ports:
      - "4566:4566"