CloudFront VPC origins, Route 53 private zones, Cognito auth events, and S3 access point authorization

October 21, 2026 · v1.5.31

v1.5.31 adds CloudFront VPC origins and distribution web ACLs, Route 53 private hosted zones with their VPC associations, and Cognito auth events. Under AUTH=true, requests through S3 access points are checked on the access point and its bucket, and S3 Control access point and Multi-Region Access Point requests authorize the operation they actually run. It also keeps ELBv2 listener TLS settings and rule transforms, S3 replication options and Step Functions encryption settings, fixes SQS message digests and Node.js Lambdas under USE_SSL, and keeps Athena working on DuckDB 2.0.

New

• CloudFront — VPC origins and distribution web ACLs. CreateVpcOrigin, GetVpcOrigin, UpdateVpcOrigin, DeleteVpcOrigin and ListVpcOrigins are implemented: a change answers Deploying and the next read shows Deployed, the endpoint must be a load balancer or instance that exists in MiniStack, and an origin a distribution names can't be deleted or changed (CannotDeleteEntityWhileInUse, CannotUpdateEntityWhileInUse). AssociateDistributionWebACL and DisassociateDistributionWebACL set and clear the distribution's WebACLId, with If-Match and EntityNotFound as on AWS. Contributed by @kharabasz and @OS-kiranmalsetty.
• Cognito — auth events. on a pool with threat protection on, password, SRP and admin sign-ins, their MFA answers and password changes are logged as SignIn and PasswordChange events, AdminListUserAuthEvents lists them newest first, and AdminUpdateAuthEventFeedback and UpdateAuthEventFeedback are implemented. Contributed by @iot-rocket.
• Route 53 — private hosted zones. CreateHostedZone with a VPC made a public zone and dropped the VPC; the zone is now private and keeps its VPCs, and AssociateVPCWithHostedZone, DisassociateVPCFromHostedZone and ListHostedZonesByVPC are implemented with AWS's refusals (PublicZoneVPCAssociation, ConflictingDomainExists, VPCAssociationNotFound, LastVPCAssociation). A Cloud Map private DNS namespace's zone carries the namespace VPC. Contributed by @kharabasz.

Fixes

• S3 — access points. under AUTH=true a request through an access point alias or ARN is now checked on both the access point and its bucket, with s3:DataAccessPointArn, s3:DataAccessPointAccount and s3:AccessPointNetworkOrigin, and the access point's Block Public Access settings apply to requests through it (BlockPublicAcls refuses a public ACL with 403 AccessDenied). Contributed by @iot-rocket.
• S3 Control — access point, Object Lambda and Multi-Region Access Point requests authorize the operation they run. the IAM action was read from the path separately from the handler, so an extra segment, a double slash or a resource named policy ran an operation without its action; the action now comes from the route served, a method a resource lacks answers 405 MethodNotAllowed and an unparseable path 400 InvalidURI. Contributed by @iot-rocket.
• S3 — replication rule options. PutBucketReplication dropped SourceSelectionCriteria, EncryptionConfiguration, ReplicationTime and Metrics; they are now stored, returned and validated with AWS's codes and order (MalformedXML, InvalidArgument, InvalidRequest). Contributed by @kharabasz.
• S3 — EU location constraint. eu-west-1 accepts the legacy EU constraint again and homes the bucket in eu-west-1, GetBucketLocation answers EU for it, and other regional endpoints still refuse it. Contributed by @toby6578.
• CloudFormation — S3 bucket CORS, Block Public Access and website. AWS::S3::Bucket dropped CorsConfiguration, PublicAccessBlockConfiguration and WebsiteConfiguration; they are now stored on create, replaced on update and deleted when an update removes them. Contributed by @iot-rocket.
• Lambda — Node.js functions. under USE_SSL=1 Node requests to the gateway keep TLS on the gateway port in both executors, so cfn-response callbacks and SDK calls work, and the generated certificate names host.docker.internal. The local executor's SDK stubs now sign with the function's credentials, so a call lands in the function's account and runs as its execution role. Contributed by @iot-rocket.
• ELBv2 — listener TLS settings and rule transforms. HTTPS and TLS listeners keep SslPolicy (default ELBSecurityPolicy-2016-08) and their certificate, and more than one certificate answers TooManyCertificates (Up to '1' certificate ARNs can be specified, but '2' were specified). Rules keep their url-rewrite and host-header-rewrite Transforms, validated as AWS does, also from AWS::ElasticLoadBalancingV2::ListenerRule. Contributed by @kharabasz.
• Cognito — trigger events and user errors. the pre token generation event carries its version, TokenGeneration_NewPasswordChallenge and ClientCredentials, and every trigger's awsSdkVersion is aws-sdk-unknown-unknown. Unknown users answer User does not exist. (Username/client id combination not found. on the client calls with PreventUserExistenceErrors LEGACY), and ChangePassword checks PreviousPassword. Contributed by @iot-rocket and @jun-ut.
• Step Functions — encryption and aws-sdk:ec2 snapshots. state machines keep and validate encryptionConfiguration (AWS_OWNED_KEY when unset, a 300-second key reuse period by default), also in AWS::StepFunctions::StateMachine, and aws-sdk:ec2 snapshot results name their lifecycle State. Contributed by @kharabasz and @bandle.
• SQS — message digests. a FIFO dedup hit answers the current request's MD5OfMessageBody and MD5OfMessageAttributes, and ReceiveMessage computes MD5OfMessageAttributes over the attributes it returns, so SDKs that verify them no longer fail. Contributed by @vanessah07 and @Xevos117.
• EventBridge — archive KMS keys. CreateArchive and UpdateArchive keep KmsKeyIdentifier and DescribeArchive returns it; ListArchives entries carry only the Archive summary fields. Contributed by @kharabasz.
• WAF v2 — duplicate names. CreateIPSet and CreateRuleGroup refuse a name already used in the scope, and all four creates answer WAFDuplicateItemException with AWS WAF couldn’t perform the operation because some resource in your request is a duplicate of an existing one. Contributed by @OS-kiranmalsetty.
• IoT — # does not match the level above it. a filter ending in /# no longer receives messages published to the level above it, as on AWS IoT Core. Contributed by @iot-rocket.
• SSM — public latest Amazon Linux AMI parameters. /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 and the Amazon Linux 2 parameter resolve, also as CloudFormation AWS::SSM::Parameter::Value<AWS::EC2::Image::Id> defaults. Contributed by @bandle.
• Athena — CSV tables with DuckDB 2.0. DuckDB 2.0's type_pushdown optimizer made the CSV reader's TRY_CAST strict, failing queries on values of another type; it is disabled on the Athena connection.

Upgrade

docker pull ministackorg/ministack:1.5.31
docker run -d -p 4566:4566 ministackorg/ministack:1.5.31

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.5.31
    ports:
      - "4566:4566"