ElastiCache user groups on the engine, Glue table optimizers, ALB routing through Route 53 aliases

November 4, 2026 · v1.5.37

v1.5.37 adds Glue table optimizers, ALB routing through Route 53 alias records and a .NET Testcontainers example, enforces ElastiCache user groups on the engine, and fixes CloudFormation, DynamoDB, ECS, Lambda, EC2, RDS and Step Functions.

New

• ALB — routing through Route 53 alias records. A host with an A/AAAA alias record in a public hosted zone, exact or wildcard (*.example.com, the most specific name winning), reaches the load balancer the record targets, so one ALB can serve many hostnames. Reported by @boesing.
• Glue — table optimizers. CreateTableOptimizer, GetTableOptimizer, UpdateTableOptimizer, DeleteTableOptimizer, BatchGetTableOptimizer and ListTableOptimizerRuns store optimizers per Iceberg table with AWS's defaults and errors; they never run. Reported by @lucasmfraser.
• Testcontainers — .NET example. Testcontainers/dotnet-testcontainers runs MiniStack from Testcontainers for .NET with the AWS SDK for .NET.

Fixes

• ElastiCache — user groups on the engine. User groups on replication groups and serverless caches reach Valkey and Redis on every change, default is off unless a group has one, and users can't run ACL writes or CONFIG; a change restarts the engine, dropping open connections. CreateUserGroup and ModifyUserGroup refuse current members, non-members, unknown users and duplicates in AWS's order, a Redis OSS group needs a user named default (DefaultUserRequired), every account has the built-in default user, ModifyUser applies AppendAccessString, and a user with a selector gets no channels outside it. Contributed by @chris-plucker and @kharabasz.
• CloudFormation — cross-account files and secrets, ElastiCache user groups. A TemplateURL, nested stack, AWS::Include Location, state machine DefinitionS3Location or Lambda code in another account's bucket is read when the bucket allows it, and a secretsmanager dynamic reference resolves in the account its ARN names. An AWS::ElastiCache::UserGroup update keeps changes made outside the stack unless it changes the users or Engine, and ElastiCache failures read as AWS's handler messages. Contributed by @mishukdutta-cz and @kharabasz.
• DynamoDB — a value SET at several paths. SET a = :v, b = :v, list_append(:l, :l), if_not_exists and PartiQL UPDATE store an independent copy per path, so a nested write to one no longer shows up at the others. Contributed by @toby6578.
• ECS — secrets and MiniStack ECR images. AWS::ECS::TaskDefinition keeps every nested property, so Secrets are injected, SSM SecureString secrets arrive decrypted, and a task image from MiniStack's ECR is loaded from MiniStack's registry. Reported by @dimazuien and @kharabasz.
• EC2 — all-ports protocols. -1 and protocols other than tcp, udp, icmp and icmpv6 ignore FromPort/ToPort, so the Terraform provider's default egress revoke matches. Contributed by @kharabasz.
• Lambda — architectures, cold starts and containers. A declared Architectures pins the container platform, cold starts free their code tar and no longer collide on the context shim, and failed or abandoned containers are cleaned up and carry MiniStack's Testcontainers session labels. Contributed by @toby6578, @skialpine and @kharabasz. Reported by @chandra-purbia.
• RDS — cluster and global endpoints. Endpoints under MINISTACK_RDS_PUBLIC_ENDPOINT are stable from CreateDBCluster, and an Aurora global writer endpoint resolves to the writer on the Docker network and is in PostgreSQL members' certificates. Contributed by @kharabasz.
• Step Functions — Map states, stops and .sync. A JSONata Distributed Map evaluates its fields, ItemBatcher batches items (256 KiB by default), an Inline Map with ItemReader, ItemBatcher or ResultWriter fails with States.Runtime, a stop ends the running state, and a failed .sync child fails the parent with States.TaskFailed. Contributed by @mishukdutta-cz.

Upgrade

docker pull ministackorg/ministack:1.5.37
docker run -d -p 4566:4566 ministackorg/ministack:1.5.37

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.5.37
    ports:
      - "4566:4566"