Amazon Transcribe lands, Lambda SnapStart, ALB OIDC authentication

September 2, 2026 · v1.5.6

v1.5.6 ships Amazon Transcribe as a new service, teaches Lambda real SnapStart semantics — init at publish, pre-warmed first invoke, runtime hooks — and makes the ALB authenticate-oidc action authenticate. The IAM enforcement layer gains the managed-policy ARNs CDK actually attaches, and an unregistered Host is no longer routed by service-token substring.

New

• Amazon Transcribe. Batch transcription jobs end to end: StartTranscriptionJob walks QUEUED → IN_PROGRESS → COMPLETED, reads media from MiniStack S3, writes the transcript back in the real result format with redaction, subtitles and speaker labels honoured, and publishes Transcribe Job State Change events. The transcript is deterministic canned text — no speech recognition — so tests are reproducible. Contributed by @ppettitau.
• Lambda — SnapStart. The parameter was silently swallowed; it now round-trips with AWS's constraints enforced, and the mechanism is emulated, not just the shape: publishing a version initializes its execution environment right then, the first invoke lands warm, invoking while Pending answers ResourceConflictException, a broken init fails the publish, and snapshot-restore-py hooks run during a published version's init.
• RDS — MySQL writer quiescence primitives. Writer-fence verification, transaction/XA drain inventory and fenced GTID capture for Aurora MySQL global-cluster switchover — deadline-bounded, fail-closed, dormant until an orchestrator calls them. Contributed by @Areson.
• Glue / S3 Tables — Iceberg-Spark catalog for Glue 5.0. Glue 5.0 jobs resolve the Iceberg-Spark catalog across the Spark 3.5/3.3 differences, and the embedded Iceberg REST catalog now serves pyiceberg clients: createNamespace routes, and the format-version and schema-id defects are fixed. Reported by @kevinprince.

Fixes

• ALB — authenticate-oidc authenticates. The action's config was accepted and discarded, so every request reached the target unauthenticated. The documented flow now runs end to end — redirect, code exchange, UserInfo claims, sharded session cookies — and targets receive x-amzn-oidc-data as AWS's signed ES256 JWT with forged copies stripped. Rule actions run as a chain in Order. Contributed by @dhanesh.
• Router — an unregistered Host is not an AWS endpoint. Unanchored service-token regexes ran over any unclassified Host, so probe.iot.example.com answered Unsupported IoT path. Host patterns now apply only to hosts the stack serves, each token anchored at a label boundary; AWS-shaped hosts route exactly as before. Contributed by @iot-rocket.
• IAM — the managed policies CDK attaches resolve by their real ARNs. The catalogue now carries the Lambda execution-role policies under service-role/ — the only ARN CDK, SAM and Serverless emit — with the documents from the AWS Managed Policy Reference; the path-less spellings answer NoSuchEntity, as on AWS. Contributed by @iot-rocket.
• IAM enforcement — two AUTH=true blockers. aws:ResourceAccount resolves (CDK's own bootstrap conditions its S3 grant on it), and S3 multipart uploads authorize as the actions S3 documents — s3:PutObject and friends — instead of literal action names no policy grants. Contributed by @iot-rocket.
• Lambda — a failed Docker cold start no longer leaks its extraction directory. Anything raised between unpacking code/layers and the container start orphaned a full extraction tree, compounding to gigabytes under Docker-API pressure; cleanup now covers every exit. Reported by @iot-rocket.
• RDS — a container worker no longer clobbers an intervened stop. StopDBInstance landing while the background worker was still starting the container was undone when the worker finished; DBInstanceStatus and DB-proxy TargetHealth now stay stopped/UNAVAILABLE.

Upgrade

docker pull ministackorg/ministack:1.5.6
docker run -d -p 4566:4566 ministackorg/ministack:1.5.6

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.5.6
    ports:
      - "4566:4566"