Cognito PostAuthentication and resource indicators, CloudFront compression and cf.kvs(), Secrets Manager replication

November 8, 2026 · v1.5.39

v1.5.39 adds the Cognito PostAuthentication trigger, attribute verification, hosted UI MFA and RFC 8707 resource indicators, CloudFront Functions reading their KeyValueStore through cf.kvs(), Secrets Manager replica operations and the aws/s3 KMS key, with fixes to CloudFront compression, Cognito MFA, IAM condition keys, S3, Auto Scaling and Aurora reboots.

New

• Cognito — attribute verification, hosted UI MFA and resource indicators. GetUserAttributeVerificationCode and VerifyUserAttribute work, the hosted sign-in pages have a forgot-password flow and TOTP or SMS MFA, and on a ManagedLoginVersion 2 domain a registered resource becomes the access token's aud. Contributed by @toby6578.
• Cognito — the PostAuthentication trigger. It runs after an API sign-in, before tokens are issued and before NEW_PASSWORD_REQUIRED, but not on refresh, and a failing Lambda fails the sign-in. Reported by @ryuzo-hayashi.
• CloudFront — cf.kvs() in CloudFront Functions. import cf from 'cloudfront' works in cloudfront-js-2.0, and get(), exists() and meta() read the function's associated KeyValueStore. Reported by @mkusaka.
• Secrets Manager — replica operations. RemoveRegionsFromReplication and StopReplicationToReplica work, so terraform destroy of a secret with a replica block succeeds. Contributed by @kharabasz.
• KMS and S3 — the aws/s3 key and cross-account access points. An aws:kms write without a key ID uses the account's aws/s3 managed key, and PutObject through another account's access point succeeds when every policy allows it. Contributed by @kharabasz.

Changes

• Secrets Manager — request bodies and replica deletes. A body that is not one JSON object answers SerializationException, and DeleteSecret on a primary that still has replicas answers InvalidParameterException. Contributed by @kharabasz.

Fixes

• CloudFront — Compress: true. Eligible origin responses are gzipped (Brotli with the optional brotli package), a strong ETag becomes weak, and the origin gets the normalized Accept-Encoding. Reported by @skialpine.
• Cognito — MFA through the API. A user whose pool requires MFA and who has no factor gets MFA_SETUP, a TOTP enrolled on the hosted pages is challenged by the API, and repeated wrong codes lock the user out for a while.
• IAM — request condition keys with AUTH=true. Keys such as s3:signatureversion, kms:EncryptionContext:*, secretsmanager:VersionStage, sns:Protocol and iam:PermissionsBoundary are set from the request, so policies conditioned on them no longer deny valid requests.
• S3 — SSE-KMS keys and Multi-Region Access Points. SSE-KMS keys are resolved through KMS and set the key condition for bucket policies (contributed by @kharabasz), and ListMultiRegionAccessPoints pages no longer skip or repeat an access point.
• Auto Scaling — overrides and DesiredCapacityType. InstanceRequirements launch templates and overrides are checked with AWS's errors, and only a group with a MixedInstancesPolicy reports a DesiredCapacityType. Contributed by @kharabasz.
• RDS — Aurora member reboots. A member rebooted after a master password rotation comes back, and a cluster with a member mid-reboot no longer sticks in creating. Contributed by @jayjanssen.

Upgrade

docker pull ministackorg/ministack:1.5.39
docker run -d -p 4566:4566 ministackorg/ministack:1.5.39

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.5.39
    ports:
      - "4566:4566"