ALB authenticate-cognito, Glue GetPartitions filters and BatchDeletePartition, SES events through EventBridge

November 11, 2026 · v1.5.40

v1.5.40 adds the ALB authenticate-cognito action, Glue BatchDeletePartition and SES sending events through EventBridge, with fixes to Glue GetPartitions filtering, ECS service deployments, DynamoDB disabled streams, Cognito mapped claims, EC2 prefix list tag filters, OpenSearch change tracking, Route 53 health checks and RDS PostgreSQL roles and Aurora creates and reboots.

New

• ALB — the authenticate-cognito action. It answered 501. Users sign in through the user pool's domain and the target gets the x-amzn-oidc-* headers, x-amzn-oidc-data with the pool's issuer and a two-minute exp; deny answers ALB's 401 Authorization Required page. Reported by @boesing.
• Glue — BatchDeletePartition. Deletes up to 25 partitions, reports each missing one in Errors, and drops the deleted partitions' column statistics. Contributed by @yonatoasis.
• SES — sending events through EventBridge. Each send publishes aws.ses events to the configuration set's EventBridge destination, with the outcomes AWS gives the mailbox simulator. Adds PutEmailIdentityConfigurationSetAttributes; EventBridge now delivers to CloudWatch Logs log group targets. Contributed by @himangshuj.

Fixes

• Glue — GetPartitions filters, pages and segments. Expression, MaxResults, NextToken, Segment and ExcludeColumnSchema were ignored, so Trino's partition pruning did nothing. Expressions parse with AWS's operators, type rules and InvalidInputException messages. Contributed by @yonatoasis.
• ECS — ListServiceDeployments and DescribeServiceDeployments. Both answered an empty list, so the AWS provider's wait on a new aws_ecs_service could hang. Each deployment is now listed newest first and moves from IN_PROGRESS to SUCCESSFUL. Contributed by @kharabasz.
• DynamoDB — a stream disabled at creation. CreateTable with {"StreamEnabled": false} created a stream. Such a table now has no stream, disabling a stream keeps the last label and ARN, and disabling one a table doesn't have answers Table has no stream to disable. Reported by @Gaitholabi.
• Cognito — mapped OIDC claims that are not strings. /oauth2/idpresponse dropped mapped lists and objects and stored booleans as True; they are now stored as AWS stores them, so a mapped email_verified reads as verified. Reported by @boesing.
• EC2 — tag filters on DescribeManagedPrefixLists. AWS-managed lists carry no tags, so a tag:<key>, tag-key or tag-value filter no longer returns them. Contributed by @chris-plucker.
• OpenSearch — ChangeProgressDetails. Creating a domain, through the API or CloudFormation, and each UpdateDomainConfig start a change whose ChangeId DescribeDomain and DescribeDomainChangeProgress report. Contributed by @chris-plucker.
• Route 53 — metric, calculated and recovery-control health checks. They no longer get RequestInterval and FailureThreshold, so Terraform stops replacing them, and create and update reject what AWS rejects with its InvalidInput messages. Contributed by @kharabasz.
• RDS — PostgreSQL built-in roles. A new RDS or Aurora PostgreSQL database has rds_superuser, rds_replication and rds_password, with the master user in rds_superuser. Contributed by @chris-plucker.
• RDS — Aurora creates and reboots. Two instances created into one new cluster at once no longer report failed (contributed by @kharabasz), and two clusters rebooting at once no longer swap endpoints (contributed by @jayjanssen).
• Glue — column statistics. AnalyzedTime is integer epoch seconds, and a partition column without statistics reports Statistics do not exist for this column.

Upgrade

docker pull ministackorg/ministack:1.5.40
docker run -d -p 4566:4566 ministackorg/ministack:1.5.40

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.5.40
    ports:
      - "4566:4566"