Firehose Iceberg delivery, SSM Secrets Manager references, Lambda SNS records

November 14, 2026 · v1.5.41

v1.5.41 adds Firehose delivery to Iceberg tables on the Glue Data Catalog and SSM Secrets Manager references, with fixes to imported ACM certificates, API Gateway SNS integrations, the SNS record Lambda receives, and RDS and RDS Data API errors and Aurora MySQL shapes.

New

• Firehose — Iceberg tables on the Glue Data Catalog. An Iceberg destination never wrote to the table. Records now buffer per BufferingHints and land as one Iceberg commit per buffer, with the Glue metadata_location updated; a value that can't be converted goes to <ErrorOutputPrefix>iceberg-failed/ as Iceberg.MalformedFieldWithinRecord, and a Glue table that isn't Iceberg as Iceberg.NoSuchIcebergTable. Full image (DuckDB). Contributed by @yonatoasis.
• SSM — Secrets Manager references. GetParameter and GetParameters resolve /aws/reference/secretsmanager/<secret-id> to the secret's AWSCURRENT value as a SecureString with its ARN and SourceResult; WithDecryption must be true, a missing secret answers ParameterNotFound, and under AUTH=true the caller needs secretsmanager:GetSecretValue on the secret. Contributed by @qnm.

Fixes

• ACM — names and dates of an imported certificate. A body that parses now reports its CN as DomainName, its DNS SANs in SubjectAlternativeNames and DomainValidationOptions, and its own NotBefore / NotAfter, instead of a synthetic .invalid name. Contributed by @bryanhelmig.
• API Gateway — AWS integrations targeting SNS. An sns:path// or sns:action/{Action} integration answered 500. It now makes the SNS call from the rendered request template and maps the reply through integrationResponses. Reported by @OkButterscotch2891 on Reddit.
• SNS — the Sns record a Lambda receives. Lambda got the SQS/HTTP envelope, so a handler reading record['Sns']['Subject'] raised KeyError. Subject is now null and MessageAttributes {} when absent, with SigningCertUrl and UnsubscribeUrl. Contributed by @bryanhelmig.
• RDS — a missing cluster or DB subnet group on create. CreateDBInstance with an unknown cluster answers 404 DBClusterNotFoundFault, and CreateDBCluster with a missing DBSubnetGroupName 404 DBSubnetGroupNotFoundFault; neither creates anything. Contributed by @kharabasz and @Areson.
• RDS — global cluster failover and removal errors. FailoverGlobalCluster with AllowDataLoss and Switchover both true, and RemoveFromGlobalCluster with an over-long or unknown member ARN, answer 400 InvalidParameterValue with AWS's messages. Contributed by @Areson.
• RDS — Aurora MySQL shapes and default DB parameter groups. Clusters carry ReadReplicaIdentifiers and DomainMemberships; a member takes its cluster's DB subnet group and VPC security groups and leaves out empty lists. DescribeDBParameters answers for an Aurora family's default.<family> group. Contributed by @Areson.
• RDS Data API — a missing cluster and MySQL SELECT counts. A cluster ARN that names no cluster answers 400 HttpEndpointNotEnabledException, and a MySQL SELECT reports numberOfRecordsUpdated 0 and no generatedFields. Contributed by @Areson.

Upgrade

docker pull ministackorg/ministack:1.5.41
docker run -d -p 4566:4566 ministackorg/ministack:1.5.41

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.5.41
    ports:
      - "4566:4566"