SSM Automation, account-level public access block, cross-account EventBridge bus targets, S3 Tables Iceberg fixes

November 2, 2026 · v1.5.36

v1.5.36 adds SSM documents and Automation, the S3 Control account-level public access block and two CloudFormation resource types, and fixes behaviour across 13 services.

New

• CloudFormation — AWS::Events::Archive. Templates with an EventBridge archive deploy, with Ref, Arn, generated names, in-place updates and AWS's Early Validation messages. Contributed by @toby6578.
• CloudFormation — AWS::CloudFormation::StackSet. A self-managed StackSet with one instance in the stack's own account and Region deploys as a nested stack, and DescribeStackSet and ListStackInstances answer. Contributed by @chris-plucker.
• S3 Control — account-level public access block. PutPublicAccessBlock, GetPublicAccessBlock and DeletePublicAccessBlock on the account, applied to every bucket in every Region. Contributed by @pingedbrain.
• SSM — documents and Automation. Documents (CreateDocument, GetDocument, ListDocuments and the rest) and Automation executions that run aws:sleep, aws:executeAwsApi and aws:runCommand steps; under AUTH=true a step runs with the caller's or the document's assumeRole permissions. Contributed by @pingedbrain.

Fixes

• API Gateway — callers from any account. An execute-api URL reaches its API whoever calls it, as on AWS; an AWS_IAM method refuses a caller from another account that no API policy grants. Contributed by @chandra-purbia.
• CloudFormation — Early Validation in change sets. A change set whose template fails pre-deployment validation now fails with AWS's hook names, and validation events carry no OperationStatus. Contributed by @toby6578.
• CloudWatch Logs — eventId on every event. Events written by Lambda, CodeBuild and DynamoDB imports have an eventId, so aws logs tail --follow works. Contributed by @chandra-purbia.
• Cognito — Lambda trigger errors. A failing PreTokenGeneration Lambda fails the request with UserLambdaValidationException or UnexpectedLambdaException, PreSignUp and CustomMessage errors use AWS's <trigger> failed with error … text, and MINISTACK_COGNITO_PRETOKEN_STRICT is removed. Contributed by @ryuzo-hayashi.
• ElastiCache — endpoints after a restart. A replication group respawned after a restart reports its new container's address. Reported by @chris-plucker.
• EventBridge — targets in other accounts and Regions. Event bus targets in another account or Region are delivered with AWS's hop limits, another account's SQS queue needs a RoleArn (and under AUTH=true a queue policy allowing it), PutEvents to another Region's bus is refused, and CreateArchive refuses a missing bus. Contributed by @toby6578 and @chandra-purbia. Reported by @lucasmfraser.
• KMS — keys in other accounts. Another account's key is governed by its key policy, and missing keys and denials answer with AWS's codes and messages. Contributed by @Jolley71717. Reported by @kharabasz.
• Lambda — Node.js 24 and Docker images. nodejs24.x refuses callback-based handlers with Runtime.CallbackHandlerDeprecated, "type": "module" packages run under LAMBDA_EXECUTOR=docker, and an arm64 function no longer breaks the next one that declares no architecture. Contributed by @Jolley71717. Reported by @evan-burrell.
• RDS — Aurora parameter groups and upgrades. Each Aurora family has its default.<family> cluster parameter group, a major upgrade needs AllowMajorVersionUpgrade and moves the cluster to the new family's default, and a master password reset shows as pending before it settles. Contributed by @chris-plucker.
• S3 — object tags. CreateMultipartUpload keeps its Tagging, and an overwritten object's tags and ACL no longer carry over to the new one. Contributed by @zalefin.
• S3 Tables — Iceberg REST. dropTable and dropNamespace are served as on AWS, createTable assigns the location and requires stage-create (fixing Trino's "location": null), and field ids are renumbered with last-column-id counting nested fields. Contributed by @Jolley71717. Reported by @Wazabit.
• Secrets Manager — PrimaryRegion. A replicated secret's primary reports its own Region. Contributed by @chris-plucker.
• Step Functions — ecs:runTask.sync. A task whose essential container exits non-zero, or that never starts, fails the state with States.TaskFailed; otherwise the result is the stopped task. Reported by @lucasmfraser.

Upgrade

docker pull ministackorg/ministack:1.5.36
docker run -d -p 4566:4566 ministackorg/ministack:1.5.36

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.5.36
    ports:
      - "4566:4566"