RDS IAM auth for PostgreSQL, Cognito refresh token rotation, EventBridge global endpoints

November 5, 2026 · v1.5.38

v1.5.38 adds IAM database authentication for PostgreSQL, Cognito refresh token rotation, the CustomEmailSender trigger and managed login branding, and the ALB authenticate-oidc signing key, with fixes to ALB, EventBridge, Lambda, ACM, EFS, Auto Scaling and API Gateway, and three security fixes.

New

• RDS — IAM database authentication for PostgreSQL. A role granted rds_iam logs in to a PostgreSQL or Aurora PostgreSQL instance or cluster with a token from generate_db_auth_token, checked as for MySQL. Reported by @kharabasz.
• Cognito — refresh token rotation, CustomEmailSender and managed login branding. A client with RefreshTokenRotation gets a new refresh token on every refresh, the CustomEmailSender trigger receives Cognito's emails with the code encrypted under the pool's KMS key, and the five managed login branding operations and AWS::Cognito::ManagedLoginBranding work. Contributed by @toby6578.
• ALB — the authenticate-oidc signing key. The key that signs x-amzn-oidc-data is served by kid on public-keys.auth.elb..amazonaws.com/ and /_ministack/elb/public-keys/. Reported by @boesing.

Fixes

• ALB — token refresh and the data plane. authenticate-oidc refreshes an expired access token from the IdP, load balancers are found in every account and region, and /_alb// selects the load balancer whatever the Host. Contributed by @kharabasz. Reported by @boesing and @skialpine.
• EventBridge and Core — global endpoints and SigV4a. PutEvents with EndpointId delivers in the primary region and replicates to the secondary bus, and SigV4a requests run as the signing account. Contributed by @kharabasz.
• ACM, EFS and Auto Scaling. Certificate Options are stored and updated as AWS does, EFS policies come back in AWS's canonical form, and SpotInstancePools follows the Spot allocation strategy. Contributed by @kharabasz.
• API Gateway — imported OpenAPI documents. x-amazon-apigateway-any-method becomes an ANY method and an operation's parameters become method.request.* parameters. Contributed by @mishukdutta-cz.
• Lambda — errors, exits and Docker networks. MiniStack's own failures answer ServiceException, exiting runtimes Runtime.ExitError, handler errors carry the runtime's error document, a containerised MiniStack reaches its Lambda containers without DOCKER_NETWORK, and the local Node shim has ListTagsCommand and Lambda.send(). Contributed by @bpmiranda3099. Reported by @kharabasz.
• S3, Cognito, ECS, RDS and Docker-backed services. Object Lock survives a restart, CompleteMultipartUpload checks the part list, Cognito codes and invitations go where AWS sends them, ECR images run on the containerd image store, and taken host ports are skipped. Contributed by @toby6578. Reported by @kharabasz.
• About 40 services — requests, responses, errors and paging. Create and update parameters are kept, responses carry only botocore's members, List and Describe calls page with AWS's token, and error codes and HTTP statuses are AWS's wire values.

Security

• Aurora DSQL — the backend Postgres. With DSQL_STRICT=1 each cluster's trust-auth Postgres is no longer published on every interface. Contributed by @toby6578.
• EventBridge — DescribeConnection. No longer returns a connection's stored secrets.
• Containers MiniStack starts. RDS, ElastiCache, OpenSearch, MWAA, EKS, DocumentDB and ECS task ports follow MiniStack's own loopback binding.

Upgrade

docker pull ministackorg/ministack:1.5.38
docker run -d -p 4566:4566 ministackorg/ministack:1.5.38

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.5.38
    ports:
      - "4566:4566"