CloudFormation in-place updates complete, planned Aurora MySQL switchover, S3 Multi-Region Access Points

September 5, 2026 · v1.5.8

v1.5.8 completes the CloudFormation in-place update work: nineteen resource types now update through their service's own APIs instead of being destroyed and re-created, a failed update rolls back without deleting resources it didn't create, and an update that changes nothing is refused with CloudFormation's own No updates are to be performed. On the provisioning side, AWS::IoT::ThingGroup, the five CloudFront policy/OAC/function types and S3 Multi-Region Access Points deploy. RDS gains a planned Aurora MySQL switchover that runs a real no-data-loss writer exchange, and DynamoDB closes a batch of PartiQL and validation gaps measured against real DynamoDB.

New

• CloudFormation — AWS::IoT::ThingGroup provisions. A stack carrying a thing group rolled back with Unsupported resource type while the thing-group API worked. It now provisions through CreateThingGroup (ThingGroupProperties and ParentGroupName applied, a name generated when ThingGroupName is omitted), Ref returns the thing group id, Fn::GetAtt serves Arn and Id, properties update in place, and a rename or re-parent replaces, as the resource reference documents. Contributed by @iot-rocket.
• CloudFront — the policy, OAC and function types provision. AWS::CloudFront::CachePolicy, OriginRequestPolicy, ResponseHeadersPolicy, OriginAccessControl and Function had complete APIs and no provisioner. Each now provisions through the service's own config parser, so validation and defaults match the API path, and Ref/Fn::GetAtt return the documented values. Contributed by @mm-salesqueze.
• S3 — Multi-Region Access Points deploy and serve. AWS::S3::MultiRegionAccessPoint provisions, minting the .mrap-suffixed alias S3 uses, and <alias>.accesspoint.s3-global.amazonaws.com resolves onto the regular S3 path — the member whose bucket region matches the request region is served, else the first. SigV4A is not verified, consistent with the documented no-SigV4 stance. Contributed by @mm-salesqueze.
• RDS — planned Aurora MySQL switchover runs on the data plane. SwitchoverGlobalCluster (and FailoverGlobalCluster without data loss allowed) on a provisioned two-member Aurora MySQL 8 global cluster performs a coordinated no-data-loss writer exchange: the source writer is fenced and drained, GTID convergence awaited, replication reversed and verified, and the promoted target verified writable, with recovery state persisted across restarts. Non-native configurations and AllowDataLoss=true keep the metadata-only path. Contributed by @Areson.
• RDS — FailoverDBCluster promotes replicated PostgreSQL readers. Under MINISTACK_RDS_PG_CLUSTER_REPLICATION=1, failover calls pg_promote() on the selected hot standby, makes it the writer endpoint, and re-clones the former writer as a read-only standby. Metadata changes only after promotion succeeds. Contributed by @kiran01bm.

Fixes

• CloudFormation — in-place updates complete. Nineteen types now update in place through their service's own APIs — the four Cognito types (including EnabledMfas), SecretsManager::Secret (a changed value becomes the new AWSCURRENT, same ARN, history kept), Kinesis::Stream, ECR::Repository, DynamoDB::GlobalTable, Events::EventBus, Events::Rule, CodeBuild::Project, Route53::RecordSet, Scheduler::Schedule, StepFunctions::StateMachine, CloudWatch::Alarm, IAM::Policy, ApiGateway::Authorizer, ApiGateway::Deployment and KMS::Alias — replacing only for the properties the resource references mark Replacement, with the engine deleting a replaced resource's predecessor in a cleanup phase as CloudFormation does. AWS::Lambda::Permission, where every property requires replacement, swaps its statement under a fresh generated Sid and carries all nine documented properties. Contributed by @iot-rocket.
• CloudFormation — a failed update rolls back cleanly. The rollback deleted every resource the run had touched — and a run touches every resource in the template; it now deletes only what the update created. After UPDATE_ROLLBACK_COMPLETE the stack also reports what it ran before: GetTemplate returns the previous template and DescribeStacks the previous parameters and tags, so a cdk diff after a failed deploy compares against the right base. Contributed by @iot-rocket.
• CloudFormation — request hygiene. An UpdateStack that changes nothing is refused with ValidationError: No updates are to be performed. (a "deploy until nothing changes" loop now ends); a template with an unrecognized resource type or a dynamic reference is refused synchronously with Template format error: Unrecognized resource types: [...] instead of provisioning half the stack first; Fn::GetAtt to an attribute a resource does not expose fails the operation instead of answering the physical id; DeleteChangeSet of a change set that does not exist succeeds, so cdk deploy of an existing stack stops aborting; and DeleteStack blocks on an export only when another stack really imports it through Fn::ImportValue, not when its template merely mentions the name. Contributed by @iot-rocket.
• CloudFormation — two provisioner reads. AWS::Events::Rule reports the rule ARN the EventBridge service reports (no bus segment on the default bus), and AWS::Cognito::UserPool honours the documented UserPoolName property (PoolName stays accepted). Contributed by @iot-rocket.
• CloudWatch — PutMetricAlarm keeps the state timestamp. Re-putting an alarm stamped a fresh StateUpdatedTimestamp, reporting a state change that never happened; the state, its reason and its timestamp now survive and only AlarmConfigurationUpdatedTimestamp moves, as the API reference documents. Contributed by @iot-rocket.
• IAM — the remaining S3 operations authorize as S3 documents them. Under AUTH=true, browser POST Object, versioned reads and deletes, DeleteObjects per key, copy sources, GetObjectAttributes, governance bypass and fifteen sub-resources each map to the action the S3 reference lists. Contributed by @iot-rocket.
• DynamoDB — PartiQL and validation parity. ExecuteStatement serves SELECT from "table"."index" (membership, projection and capacity follow the index), document paths in SET/REMOVE, OR predicates and RETURNING MODIFIED; Query/Scan answer the Select/ProjectionExpression refusals with real DynamoDB's wording, nested-attribute key conditions are rejected, ConsumedCapacity lands on the index arm, and secondary-index key values are validated on writes and transactions. Reported by the paritysuite.org project.
• Lambda — durable executions emit the complete history event set. Four documented event types were never emitted: InvocationCompleted per handler invocation, ExecutionTimedOut with DurableConfig.ExecutionTimeout now enforced, ChainedInvokeTimedOut for in-flight chained invokes, and ChainedInvokeStopped on stop — with ChainedInvokeStarted on the log before a fast child can complete.
• Identity hygiene. Cognito's PreSignUp trigger fires on plain SignUp, fail-closed, with autoConfirmUser/autoVerify* honoured; STS sessions expire (403 ExpiredToken) and are evicted instead of growing forever.

Upgrade

docker pull ministackorg/ministack:1.5.8
docker run -d -p 4566:4566 ministackorg/ministack:1.5.8

Or pin in compose.yaml:

services:
  ministack:
    image: ministackorg/ministack:1.5.8
    ports:
      - "4566:4566"