DEV Community: Yoshiyuki Watanabe

Trying MiniStack and StackPort

Yoshiyuki Watanabe — Tue, 13 Oct 2026 21:52:57 +0000

Introduction

I tried MiniStack, a free local AWS emulator, and StackPort, a browser-based viewer for its resources.

MiniStack

Free, open-source local AWS emulator. Free forever.

60+ AWS services on a single port · Multi-account & multi-region · Terraform compatible · Real databases · MIT licensed

Ministack.org · Docker Hub · LinkedIn

Why MiniStack?

LocalStack recently moved its core services behind a paid plan. If you relied on LocalStack Community for local development and CI/CD pipelines, MiniStack is your free alternative.

60+ AWS services emulated on a single port (4566)
Drop-in compatible — works with boto3, AWS CLI, Terraform, CDK, Pulumi, any SDK
Multi-account & multi-region — a 12-digit access key becomes the account, the SigV4 region scopes the state; isolated tenants and regions on one endpoint, like real AWS
Amazon Bedrock locally — Converse / InvokeModel with AWS-exact wire shapes; point MINISTACK_BEDROCK_PROXY_URL at Ollama, llama.cpp, or vLLM and get real completions through the Bedrock API
Real infrastructure — RDS spins up actual Postgres/MySQL containers, ElastiCache spins…

View on GitHub

StackPort

Universal AWS resource browser for local emulators and real AWS accounts.

Browse, inspect, and manage resources across 35 AWS services with dedicated UIs for S3, DynamoDB, Lambda, SQS, IAM, EC2, CloudWatch Logs, and Secrets Manager.

Screenshots

Dashboard — Service overview with resource counts and health status

Lambda Browser — Function list with config, aliases, versions, event sources, and invocation panel

S3 Browser — File browser with upload, download, folder navigation, and tagging

Features

Browse and inspect resources across 35 AWS services
8 dedicated service UIs for S3, DynamoDB, Lambda, SQS, IAM, EC2, CloudWatch Logs, and Secrets Manager
Write operations — upload/delete S3 objects, query DynamoDB, invoke Lambda, send/receive SQS messages
Real AWS support — connect to real AWS accounts with read-only mode by default
Per-endpoint authentication — default credentials, AWS profiles (SSO/AssumeRole), or static keys per endpoint
Guided lessons — hands-on AWS tutorials that run inside the console and…

View on GitHub

This article builds the following pipeline:

EventBridge Scheduler invokes a Lambda function on a schedule
The Lambda function calls an API and publishes the result to SNS
SNS triggers a second Lambda function, which posts to a Slack Incoming Webhook
The API key and the Webhook URL are stored as SecureString parameters in SSM Parameter Store

What Are MiniStack and StackPort?

MiniStack

MiniStack is a local AWS emulator under the MIT license. You can use more than 60 AWS services directly from the AWS CLI, boto3, Terraform, and CDK.

MiniStack — The Best AWS Emulator | Free Open-Source LocalStack Alternative

The best AWS emulator and the best alternative to LocalStack. 60+ AWS services free forever — real Postgres, Redis, Docker containers, full Terraform / CDK / Pulumi support. MIT licensed.

ministack.org

StackPort

StackPort is a tool for browsing the resources of local emulators and real AWS accounts in a browser. It connects to emulators other than MiniStack (such as LocalStack) and to real AWS accounts.

StackPort: open-source web console for AWS emulators

StackPort is a free, open-source web console for MiniStack, Floci, LocalStack, Moto and real AWS. Browse 35 services, use 13 dedicated views, and learn AWS with guided lessons. One Docker image.

stackport.cloud

StackPort lets you browse the resources of 35 services.

Eight of them have dedicated screens: S3, DynamoDB, Lambda, SQS, IAM, EC2, CloudWatch Logs, and Secrets Manager. For example, CloudWatch Logs lets you drill down from log groups to log streams to log events.

The other services (such as SSM in this article) are shown as a searchable resource table with a JSON detail view.

Note that StackPort does not support EventBridge Scheduler. The events service only shows EventBridge rules and event buses, so I check the schedule with the CLI.

Architecture

Locally, I run a mock server (mock-api) in place of the external API. For Slack, I use a real Incoming Webhook, with separate channels for the local and AWS environments.

Two things differ between the local environment and real AWS:

External API: mock-api locally, API Gateway (MOCK integration) on real AWS. Both return GET /v1/status
Slack destination: #notify-demo-local locally, #notify-demo-aws on real AWS

The directory structure is as follows. Terraform is split into a shared module (modules/notify) and one directory per environment (environments/local and environments/aws). Each environment has its own state.

code/
├── lambda/                          # Shared: the same code runs locally and on real AWS
│   ├── fetch_status/
│   │   └── app.py
│   └── notify_slack/
│       └── app.py
├── mock-api/                        # Local only: mock server standing in for the external API
│   ├── Dockerfile
│   └── server.py
├── scripts/
│   ├── put-parameters-aws.sh        # AWS only: registers parameters in the real SSM
│   └── put-parameters.sh            # Local only: registers parameters in MiniStack's SSM
├── terraform/
│   ├── environments/
│   │   ├── aws/                     # For real AWS: points at real AWS
│   │   │   ├── main.tf
│   │   │   ├── outputs.tf
│   │   │   ├── providers.tf
│   │   │   ├── terraform.tfvars
│   │   │   ├── terraform.tfvars.example
│   │   │   └── variables.tf
│   │   └── local/                   # For local: points at MiniStack
│   │       ├── main.tf
│   │       ├── outputs.tf
│   │       ├── providers.tf
│   │       ├── terraform.tfvars
│   │       ├── terraform.tfvars.example
│   │       └── variables.tf
│   └── modules/
│       └── notify/                  # Shared: Lambda, SNS, Scheduler, IAM, and more
│           ├── main.tf
│           ├── outputs.tf
│           ├── variables.tf
│           └── versions.tf
└── docker-compose.yml               # Local only: starts MiniStack, StackPort, and mock-api

Building the Local Environment

You need Docker (Docker Desktop, OrbStack, and so on), Terraform, and the AWS CLI.

Step 1: Start MiniStack, StackPort, and the Mock Server

Start three containers with docker-compose.yml.

services:
  ministack:
    image: ministackorg/ministack:latest
    ports:
      - "4566:4566"
    environment:
      - MINISTACK_REGION=ap-northeast-1
    healthcheck:
      test:
        [
          "CMD",
          "python",
          "-c",
          "import urllib.request; urllib.request.urlopen('http://localhost:4566/_ministack/health')",
        ]
      interval: 5s
      timeout: 3s
      retries: 5

  stackport:
    image: davireis/stackport:latest
    ports:
      - "8080:8080"
    environment:
      - AWS_ENDPOINT_URL=http://ministack:4566
      - AWS_REGION=ap-northeast-1
      - AWS_ACCESS_KEY_ID=test
      - AWS_SECRET_ACCESS_KEY=test
    healthcheck:
      test:
        [
          "CMD",
          "python",
          "-c",
          "import urllib.request; urllib.request.urlopen('http://localhost:8080/api/health')",
        ]
      interval: 10s
      timeout: 3s
      retries: 3
    restart: unless-stopped
    depends_on:
      ministack:
        condition: service_healthy

  # Mock server standing in for the external API
  mock-api:
    build: ./mock-api
    ports:
      - "8000:8000"
    environment:
      - EXPECTED_API_KEY=local-dummy-api-key

The three containers are:

ministack: the local AWS emulator. It accepts AWS API calls on port 4566
stackport: a web UI for browsing MiniStack's resources. It opens on port 8080
mock-api: a mock server standing in for the external API. It runs on port 8000

mock-api is written with only the Python standard library. It has one endpoint that validates the x-api-key header and returns a status.

    def do_GET(self):
        if self.path == "/v1/status":
            if self.headers.get("x-api-key") != EXPECTED_API_KEY:
                return self._send(403, {"message": "Forbidden"})
            return self._send(200, {"status": "ok"})
        return self._send(404, {"message": "not found"})

Start the containers.

cd code
docker compose up -d --build

Open http://localhost:8080 in a browser to see the StackPort dashboard.

Step 2: Register SecureString Parameters in SSM Parameter Store

I register the API key and the Webhook URL outside Terraform.

If you create them as aws_ssm_parameter resources in Terraform, the values remain in the state file in plain text. Write-only arguments (value_wo) in Terraform 1.11 and later keep them out of the state, but I don't use them here.

I prepared a script (scripts/put-parameters.sh) to register them.

#!/usr/bin/env bash
set -euo pipefail

: "${SLACK_WEBHOOK_URL:?Set SLACK_WEBHOOK_URL}"

export AWS_ACCESS_KEY_ID=test
export AWS_SECRET_ACCESS_KEY=test
export AWS_DEFAULT_REGION=ap-northeast-1
ENDPOINT=http://localhost:4566

aws --endpoint-url="$ENDPOINT" ssm put-parameter \
  --name /notify-demo/api-key \
  --type SecureString \
  --value local-dummy-api-key \
  --overwrite

aws --endpoint-url="$ENDPOINT" ssm put-parameter \
  --name /notify-demo/slack-webhook-url \
  --type SecureString \
  --value "$SLACK_WEBHOOK_URL" \
  --overwrite

For the Webhook URL, I use an Incoming Webhook issued for a Slack channel dedicated to local testing (#notify-demo-local).

SLACK_WEBHOOK_URL=<Webhook URL of the local channel> ./scripts/put-parameters.sh

Running the script adds the parameters.

The displayed value is ENCRYPTED: followed by a base64 string. It is not encrypted with KMS, and anyone can decode it back to the original value, so be careful when sharing screenshots.

Step 3: Write the Lambda Code

This is the Lambda function that calls the API (fetch_status). It gets the API key from SSM and publishes the API response to SNS.

import json
import os
import urllib.request

import boto3

ssm = boto3.client("ssm")
sns = boto3.client("sns")

API_BASE_URL = os.environ["API_BASE_URL"]
API_KEY_PARAM = os.environ["API_KEY_PARAM"]
RESULT_TOPIC_ARN = os.environ["RESULT_TOPIC_ARN"]

_api_key = None


def get_api_key():
    # Fetch from SSM only on a cold start; use the cache afterwards
    global _api_key
    if _api_key is None:
        res = ssm.get_parameter(Name=API_KEY_PARAM, WithDecryption=True)
        _api_key = res["Parameter"]["Value"]
    return _api_key


def handler(event, context):
    req = urllib.request.Request(
        f"{API_BASE_URL}/v1/status",
        headers={"x-api-key": get_api_key()},
    )
    # 4xx/5xx raise HTTPError, which makes the Lambda invocation fail
    with urllib.request.urlopen(req, timeout=10) as res:
        result = json.loads(res.read())
    print(f"API status: {result['status']}")

    sns.publish(
        TopicArn=RESULT_TOPIC_ARN,
        Subject="API status check",
        Message=json.dumps(result, ensure_ascii=False),
    )
    return result

This is the Lambda function for Slack notifications (notify_slack). It extracts the SNS message and posts it to the Webhook.

def handler(event, context):
    for record in event["Records"]:
        result = json.loads(record["Sns"]["Message"])
        now = datetime.now().astimezone().strftime("%Y-%m-%d %H:%M:%S %Z")
        text = f":white_check_mark: API status: {result['status']} ({now})"

        req = urllib.request.Request(
            get_webhook_url(),
            data=json.dumps({"text": text}).encode(),
            headers={"Content-Type": "application/json"},
            method="POST",
        )
        with urllib.request.urlopen(req, timeout=10):
            pass
        print(text)

Neither piece of code contains any MiniStack-specific endpoint configuration. MiniStack injects AWS_ENDPOINT_URL into the Lambda execution environment, so boto3 automatically points at MiniStack. The same code can be deployed to real AWS as is.

Step 4: Create the Resources with Terraform

The resources live in the shared module (terraform/modules/notify/main.tf). I don't show every resource. Instead, I excerpt the points I designed to work on both MiniStack and real AWS.

The external API URL is passed through the module variable api_base_url.

resource "aws_lambda_function" "fetch_status" {
  function_name    = local.fetch_name
  role             = aws_iam_role.fetch_status.arn
  runtime          = "python3.14"
  handler          = "app.handler"
  filename         = data.archive_file.fetch_status.output_path
  source_code_hash = data.archive_file.fetch_status.output_base64sha256
  timeout          = 30

  environment {
    variables = {
      API_BASE_URL     = var.api_base_url
      API_KEY_PARAM    = local.api_key_param
      RESULT_TOPIC_ARN = aws_sns_topic.result.arn
    }
  }

  depends_on = [aws_cloudwatch_log_group.fetch_status]
}

terraform/environments/ contains one directory per environment (local and aws). Each has a main.tf that calls the shared module and its own environment-specific settings.

The only differences are providers.tf, which decides the connection target, and terraform.tfvars, which decides the external API URL.

Because the directories are separate, the state is also separate for each environment.

In terraform/environments/local/providers.tf, the provider points only the services I use at MiniStack.

provider "aws" {
  access_key                  = "test"
  secret_key                  = "test"
  region                      = "ap-northeast-1"
  skip_credentials_validation = true
  skip_metadata_api_check     = true
  skip_requesting_account_id  = true

  endpoints {
    iam       = "http://localhost:4566"
    lambda    = "http://localhost:4566"
    logs      = "http://localhost:4566"
    scheduler = "http://localhost:4566"
    sns       = "http://localhost:4566"
    ssm       = "http://localhost:4566"
    sts       = "http://localhost:4566"
  }
}

These are the settings that make it work with MiniStack:

access_key, secret_key: dummy values (test)
region: the region to deploy to
skip_credentials_validation: skips validating credentials through the STS API
skip_metadata_api_check: skips the check against the AWS metadata API
skip_requesting_account_id: skips retrieving the account ID
endpoints: points each service at MiniStack. Specify only the services you use

The local directory (terraform/environments/local/main.tf) calls the module. The external API URL is passed through the variable api_base_url.

module "notify" {
  source = "../../modules/notify"

  region       = "ap-northeast-1"
  api_base_url = var.api_base_url
}

The variable's value goes in terraform/environments/local/terraform.tfvars. Because this file is not managed in Git, create it by copying the template (terraform.tfvars.example). The Lambda function runs inside the MiniStack container, so it reaches mock-api by its Compose service name.

api_base_url = "http://mock-api:8000"

Apply it.

cd terraform/environments/local
cp terraform.tfvars.example terraform.tfvars
# Edit terraform.tfvars if needed
terraform init
terraform apply

Here is the result. The resources are created in MiniStack's default account ID (000000000000).

$ terraform apply
module.notify.data.archive_file.notify_slack: Reading...
module.notify.data.archive_file.fetch_status: Reading...
module.notify.data.archive_file.notify_slack: Read complete after 0s [id=68fb7c506afbeeab169fb65494efc63dd8acba90]
module.notify.data.archive_file.fetch_status: Read complete after 0s [id=013b111cb8285884b651e501fd6f84ad373f787a]
module.notify.data.aws_iam_policy_document.lambda_assume: Reading...
module.notify.data.aws_caller_identity.current: Reading...
module.notify.data.aws_iam_policy_document.lambda_assume: Read complete after 0s [id=2690255455]
module.notify.data.aws_caller_identity.current: Read complete after 0s [id=000000000000]
module.notify.data.aws_iam_policy_document.scheduler_assume: Reading...
module.notify.data.aws_iam_policy_document.notify_slack: Reading...
module.notify.data.aws_iam_policy_document.scheduler_assume: Read complete after 0s [id=644537899]
module.notify.data.aws_iam_policy_document.notify_slack: Read complete after 0s [id=2364181876]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create
 <= read (data resources)

Terraform will perform the following actions:

  # module.notify.data.aws_iam_policy_document.fetch_status will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "fetch_status" {
      + id            = (known after apply)
      + json          = (known after apply)
      + minified_json = (known after apply)

      + statement {
          + actions   = [
              + "ssm:GetParameter",
            ]
          + resources = [
              + "arn:aws:ssm:ap-northeast-1:000000000000:parameter/notify-demo/api-key",
            ]
        }
      + statement {
          + actions   = [
              + "sns:Publish",
            ]
          + resources = [
              + (known after apply),
            ]
        }
    }

  # module.notify.data.aws_iam_policy_document.scheduler will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "scheduler" {
      + id            = (known after apply)
      + json          = (known after apply)
      + minified_json = (known after apply)

      + statement {
          + actions   = [
              + "lambda:InvokeFunction",
            ]
          + resources = [
              + (known after apply),
            ]
        }
    }

  # module.notify.aws_cloudwatch_log_group.fetch_status will be created
  + resource "aws_cloudwatch_log_group" "fetch_status" {
      + arn                         = (known after apply)
      + deletion_protection_enabled = (known after apply)
      + id                          = (known after apply)
      + log_group_class             = (known after apply)
      + name                        = "/aws/lambda/notify-demo-fetch-status"
      + name_prefix                 = (known after apply)
      + region                      = "ap-northeast-1"
      + retention_in_days           = 7
      + skip_destroy                = false
      + tags_all                    = (known after apply)
    }

  # module.notify.aws_cloudwatch_log_group.notify_slack will be created
  + resource "aws_cloudwatch_log_group" "notify_slack" {
      + arn                         = (known after apply)
      + deletion_protection_enabled = (known after apply)
      + id                          = (known after apply)
      + log_group_class             = (known after apply)
      + name                        = "/aws/lambda/notify-demo-notify-slack"
      + name_prefix                 = (known after apply)
      + region                      = "ap-northeast-1"
      + retention_in_days           = 7
      + skip_destroy                = false
      + tags_all                    = (known after apply)
    }

  # module.notify.aws_iam_role.fetch_status will be created
  + resource "aws_iam_role" "fetch_status" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "lambda.amazonaws.com"
                        }
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "notify-demo-fetch-status-role"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)

      + inline_policy (known after apply)
    }

  # module.notify.aws_iam_role.notify_slack will be created
  + resource "aws_iam_role" "notify_slack" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "lambda.amazonaws.com"
                        }
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "notify-demo-notify-slack-role"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)

      + inline_policy (known after apply)
    }

  # module.notify.aws_iam_role.scheduler will be created
  + resource "aws_iam_role" "scheduler" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Condition = {
                          + StringEquals = {
                              + "aws:SourceAccount" = "000000000000"
                            }
                        }
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "scheduler.amazonaws.com"
                        }
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "notify-demo-scheduler-role"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)

      + inline_policy (known after apply)
    }

  # module.notify.aws_iam_role_policy.fetch_status will be created
  + resource "aws_iam_role_policy" "fetch_status" {
      + id          = (known after apply)
      + name        = (known after apply)
      + name_prefix = (known after apply)
      + policy      = (known after apply)
      + role        = (known after apply)
    }

  # module.notify.aws_iam_role_policy.notify_slack will be created
  + resource "aws_iam_role_policy" "notify_slack" {
      + id          = (known after apply)
      + name        = (known after apply)
      + name_prefix = (known after apply)
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = "ssm:GetParameter"
                      + Effect   = "Allow"
                      + Resource = "arn:aws:ssm:ap-northeast-1:000000000000:parameter/notify-demo/slack-webhook-url"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + role        = (known after apply)
    }

  # module.notify.aws_iam_role_policy.scheduler will be created
  + resource "aws_iam_role_policy" "scheduler" {
      + id          = (known after apply)
      + name        = (known after apply)
      + name_prefix = (known after apply)
      + policy      = (known after apply)
      + role        = (known after apply)
    }

  # module.notify.aws_iam_role_policy_attachment.fetch_status_logs will be created
  + resource "aws_iam_role_policy_attachment" "fetch_status_logs" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
      + role       = "notify-demo-fetch-status-role"
    }

  # module.notify.aws_iam_role_policy_attachment.notify_slack_logs will be created
  + resource "aws_iam_role_policy_attachment" "notify_slack_logs" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
      + role       = "notify-demo-notify-slack-role"
    }

  # module.notify.aws_lambda_function.fetch_status will be created
  + resource "aws_lambda_function" "fetch_status" {
      + architectures                  = (known after apply)
      + arn                            = (known after apply)
      + code_sha256                    = (known after apply)
      + filename                       = "./build/fetch_status.zip"
      + function_name                  = "notify-demo-fetch-status"
      + handler                        = "app.handler"
      + id                             = (known after apply)
      + invoke_arn                     = (known after apply)
      + last_modified                  = (known after apply)
      + memory_size                    = 128
      + package_type                   = "Zip"
      + publish                        = false
      + qualified_arn                  = (known after apply)
      + qualified_invoke_arn           = (known after apply)
      + region                         = "ap-northeast-1"
      + reserved_concurrent_executions = -1
      + response_streaming_invoke_arn  = (known after apply)
      + role                           = (known after apply)
      + runtime                        = "python3.14"
      + signing_job_arn                = (known after apply)
      + signing_profile_version_arn    = (known after apply)
      + skip_destroy                   = false
      + source_code_hash               = "So5oKi3b/bEDekVIzzKxoKwo1aO2n/JdG+Ioj2nhtVw="
      + source_code_size               = (known after apply)
      + tags_all                       = (known after apply)
      + timeout                        = 30
      + version                        = (known after apply)

      + environment {
          + variables = (known after apply)
        }

      + ephemeral_storage (known after apply)

      + logging_config (known after apply)

      + tracing_config (known after apply)
    }

  # module.notify.aws_lambda_function.notify_slack will be created
  + resource "aws_lambda_function" "notify_slack" {
      + architectures                  = (known after apply)
      + arn                            = (known after apply)
      + code_sha256                    = (known after apply)
      + filename                       = "./build/notify_slack.zip"
      + function_name                  = "notify-demo-notify-slack"
      + handler                        = "app.handler"
      + id                             = (known after apply)
      + invoke_arn                     = (known after apply)
      + last_modified                  = (known after apply)
      + memory_size                    = 128
      + package_type                   = "Zip"
      + publish                        = false
      + qualified_arn                  = (known after apply)
      + qualified_invoke_arn           = (known after apply)
      + region                         = "ap-northeast-1"
      + reserved_concurrent_executions = -1
      + response_streaming_invoke_arn  = (known after apply)
      + role                           = (known after apply)
      + runtime                        = "python3.14"
      + signing_job_arn                = (known after apply)
      + signing_profile_version_arn    = (known after apply)
      + skip_destroy                   = false
      + source_code_hash               = "M+ENHhkFRJqThFhPFiREbrEpiqqEf0cJLzdvTNzrMUY="
      + source_code_size               = (known after apply)
      + tags_all                       = (known after apply)
      + timeout                        = 30
      + version                        = (known after apply)

      + environment {
          + variables = {
              + "TZ"                = "Asia/Tokyo"
              + "WEBHOOK_URL_PARAM" = "/notify-demo/slack-webhook-url"
            }
        }

      + ephemeral_storage (known after apply)

      + logging_config (known after apply)

      + tracing_config (known after apply)
    }

  # module.notify.aws_lambda_permission.notify_slack_from_sns will be created
  + resource "aws_lambda_permission" "notify_slack_from_sns" {
      + action              = "lambda:InvokeFunction"
      + function_name       = "notify-demo-notify-slack"
      + id                  = (known after apply)
      + principal           = "sns.amazonaws.com"
      + region              = "ap-northeast-1"
      + source_arn          = (known after apply)
      + statement_id        = "AllowExecutionFromSNS"
      + statement_id_prefix = (known after apply)
    }

  # module.notify.aws_scheduler_schedule.fetch_status will be created
  + resource "aws_scheduler_schedule" "fetch_status" {
      + action_after_completion      = (known after apply)
      + arn                          = (known after apply)
      + group_name                   = (known after apply)
      + id                           = (known after apply)
      + name                         = "notify-demo-fetch-status"
      + name_prefix                  = (known after apply)
      + region                       = "ap-northeast-1"
      + schedule_expression          = "rate(1 minute)"
      + schedule_expression_timezone = "UTC"
      + state                        = "ENABLED"

      + flexible_time_window {
          + mode = "OFF"
        }

      + target {
          + arn      = (known after apply)
          + input    = jsonencode(
                {
                  + source = "scheduler"
                }
            )
          + role_arn = (known after apply)
        }
    }

  # module.notify.aws_sns_topic.result will be created
  + resource "aws_sns_topic" "result" {
      + arn                         = (known after apply)
      + beginning_archive_time      = (known after apply)
      + content_based_deduplication = false
      + fifo_throughput_scope       = (known after apply)
      + fifo_topic                  = false
      + id                          = (known after apply)
      + maximum_message_size        = (known after apply)
      + name                        = "notify-demo-result"
      + name_prefix                 = (known after apply)
      + owner                       = (known after apply)
      + policy                      = (known after apply)
      + region                      = "ap-northeast-1"
      + signature_version           = (known after apply)
      + tags_all                    = (known after apply)
      + tracing_config              = (known after apply)
    }

  # module.notify.aws_sns_topic_subscription.result_to_notify_slack will be created
  + resource "aws_sns_topic_subscription" "result_to_notify_slack" {
      + arn                             = (known after apply)
      + confirmation_timeout_in_minutes = 1
      + confirmation_was_authenticated  = (known after apply)
      + endpoint                        = (known after apply)
      + endpoint_auto_confirms          = false
      + filter_policy_scope             = (known after apply)
      + id                              = (known after apply)
      + owner_id                        = (known after apply)
      + pending_confirmation            = (known after apply)
      + protocol                        = "lambda"
      + raw_message_delivery            = false
      + region                          = "ap-northeast-1"
      + topic_arn                       = (known after apply)
    }

Plan: 16 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + fetch_status_function_name = "notify-demo-fetch-status"

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

module.notify.aws_cloudwatch_log_group.notify_slack: Creating...
module.notify.aws_cloudwatch_log_group.fetch_status: Creating...
module.notify.aws_iam_role.fetch_status: Creating...
module.notify.aws_iam_role.scheduler: Creating...
module.notify.aws_sns_topic.result: Creating...
module.notify.aws_iam_role.notify_slack: Creating...
module.notify.aws_iam_role.fetch_status: Creation complete after 0s [id=notify-demo-fetch-status-role]
module.notify.aws_iam_role.scheduler: Creation complete after 0s [id=notify-demo-scheduler-role]
module.notify.aws_iam_role.notify_slack: Creation complete after 0s [id=notify-demo-notify-slack-role]
module.notify.aws_cloudwatch_log_group.fetch_status: Creation complete after 0s [id=/aws/lambda/notify-demo-fetch-status]
module.notify.aws_cloudwatch_log_group.notify_slack: Creation complete after 0s [id=/aws/lambda/notify-demo-notify-slack]
module.notify.aws_sns_topic.result: Creation complete after 0s [id=arn:aws:sns:ap-northeast-1:000000000000:notify-demo-result]
module.notify.aws_iam_role_policy_attachment.fetch_status_logs: Creating...
module.notify.data.aws_iam_policy_document.fetch_status: Reading...
module.notify.aws_iam_role_policy_attachment.notify_slack_logs: Creating...
module.notify.aws_iam_role_policy.notify_slack: Creating...
module.notify.data.aws_iam_policy_document.fetch_status: Read complete after 0s [id=193309822]
module.notify.aws_lambda_function.notify_slack: Creating...
module.notify.aws_lambda_function.fetch_status: Creating...
module.notify.aws_iam_role_policy_attachment.fetch_status_logs: Creation complete after 0s [id=notify-demo-fetch-status-role/arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole]
module.notify.aws_iam_role_policy.notify_slack: Creation complete after 0s [id=notify-demo-notify-slack-role:terraform-0c334b43e9f77ddf68c66755f5]
module.notify.aws_iam_role_policy_attachment.notify_slack_logs: Creation complete after 0s [id=notify-demo-notify-slack-role/arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole]
module.notify.aws_iam_role_policy.fetch_status: Creating...
module.notify.aws_iam_role_policy.fetch_status: Creation complete after 0s [id=notify-demo-fetch-status-role:terraform-5e557969d0acd65274a217f306]
module.notify.aws_lambda_function.notify_slack: Creation complete after 5s [id=notify-demo-notify-slack]
module.notify.aws_lambda_permission.notify_slack_from_sns: Creating...
module.notify.aws_lambda_permission.notify_slack_from_sns: Creation complete after 0s [id=AllowExecutionFromSNS]
module.notify.aws_sns_topic_subscription.result_to_notify_slack: Creating...
module.notify.aws_sns_topic_subscription.result_to_notify_slack: Creation complete after 0s [id=arn:aws:sns:ap-northeast-1:000000000000:notify-demo-result:8876cdbc-24f6-49f7-b09e-14fb507ff76e]
module.notify.aws_lambda_function.fetch_status: Still creating... [00m10s elapsed]
module.notify.aws_lambda_function.fetch_status: Creation complete after 10s [id=notify-demo-fetch-status]
module.notify.data.aws_iam_policy_document.scheduler: Reading...
module.notify.data.aws_iam_policy_document.scheduler: Read complete after 0s [id=1455079044]
module.notify.aws_scheduler_schedule.fetch_status: Creating...
module.notify.aws_iam_role_policy.scheduler: Creating...
module.notify.aws_scheduler_schedule.fetch_status: Creation complete after 0s [id=default/notify-demo-fetch-status]
module.notify.aws_iam_role_policy.scheduler: Creation complete after 0s [id=notify-demo-scheduler-role:terraform-db943e5a1f8c21b3a1a29f7c69]

Apply complete! Resources: 16 added, 0 changed, 0 destroyed.

Outputs:

fetch_status_function_name = "notify-demo-fetch-status"

Two functions appear on the StackPort Lambda screen.

StackPort does not show schedules, so I check them with the CLI.

$ aws --endpoint-url=http://localhost:4566 --region ap-northeast-1 \
>   scheduler list-schedules
{
    "Schedules": [
        {
            "Arn": "arn:aws:scheduler:ap-northeast-1:000000000000:schedule/default/notify-demo-fetch-status",
            "CreationDate": "2026-10-12T09:56:36.343454+09:00",
            "GroupName": "default",
            "LastModificationDate": "2026-10-12T09:56:36.343454+09:00",
            "Name": "notify-demo-fetch-status",
            "State": "ENABLED",
            "Target": {
                "Arn": "arn:aws:lambda:ap-northeast-1:000000000000:function:notify-demo-fetch-status"
            }
        }
    ]
}

Step 5: Verify the Behavior

After a short wait, API status: ok is posted to #notify-demo-local.

You can check the Lambda execution logs on the StackPort CloudWatch Logs screen. First, the log group list shows /aws/lambda/notify-demo-notify-slack and /aws/lambda/notify-demo-fetch-status.

Opening /aws/lambda/notify-demo-notify-slack shows a list of log streams, one per execution.

Opening a log stream shows START, END, and REPORT, plus what the Lambda function printed: the same API status: ok (…) that went to Slack.

Deploying to Real AWS and Verifying the Same Behavior

I deploy the pipeline I verified locally to a real AWS account and check that it behaves the same way.

The Lambda code and the Terraform module are shared with the local environment. Only the environment directory (environments/aws) and the values registered in SSM change.

The thick red borders show what differs from the local environment. An API Gateway created in advance stands in for the external API, and Slack notifications go to the AWS channel (#notify-demo-aws).

Step 1: Register the SSM Parameters

The API key was generated by the API Gateway. I retrieve its value and register it in SSM as a SecureString, together with the Incoming Webhook URL of the AWS channel.

Apart from retrieving the API key, the script is the same as the local one, so I omit its contents.

API_KEY_ID=<API key ID> SLACK_WEBHOOK_URL=<Webhook URL of the AWS channel> ./scripts/put-parameters-aws.sh

This is the Parameter Store in the AWS console after registration.

Opening a parameter shows its SecureString value as ********. Turn on "Show decrypted value" to see the value.

Step 2: Deploy

terraform/environments/aws/providers.tf has no MiniStack-specific settings.

provider "aws" {
  region = "ap-northeast-1"
}

The module call (terraform/environments/aws/main.tf) is the same as the local one.

module "notify" {
  source = "../../modules/notify"

  region       = "ap-northeast-1"
  api_base_url = var.api_base_url
}

Only the external API URL changes, in terraform/environments/aws/terraform.tfvars. This file is not managed in Git either, so create it by copying the template (terraform.tfvars.example) and rewrite it with the URL of the API Gateway you created in advance.

api_base_url = "https://<API ID>.execute-api.ap-northeast-1.amazonaws.com/prod"

Apply it.

cd terraform/environments/aws
cp terraform.tfvars.example terraform.tfvars
# Rewrite <API ID> in terraform.tfvars
terraform init
terraform apply

For comparison with the apply against MiniStack, here is the result. The account ID is masked.

$ terraform apply
module.notify.data.archive_file.fetch_status: Reading...
module.notify.data.archive_file.notify_slack: Reading...
module.notify.data.archive_file.notify_slack: Read complete after 0s [id=68fb7c506afbeeab169fb65494efc63dd8acba90]
module.notify.data.archive_file.fetch_status: Read complete after 0s [id=013b111cb8285884b651e501fd6f84ad373f787a]
module.notify.data.aws_iam_policy_document.lambda_assume: Reading...
module.notify.data.aws_caller_identity.current: Reading...
module.notify.data.aws_iam_policy_document.lambda_assume: Read complete after 0s [id=2690255455]
module.notify.data.aws_caller_identity.current: Read complete after 0s [id=123456789012]
module.notify.data.aws_iam_policy_document.scheduler_assume: Reading...
module.notify.data.aws_iam_policy_document.notify_slack: Reading...
module.notify.data.aws_iam_policy_document.notify_slack: Read complete after 0s [id=3754217979]
module.notify.data.aws_iam_policy_document.scheduler_assume: Read complete after 0s [id=991516426]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create
 <= read (data resources)

Terraform will perform the following actions:

  # module.notify.data.aws_iam_policy_document.fetch_status will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "fetch_status" {
      + id            = (known after apply)
      + json          = (known after apply)
      + minified_json = (known after apply)

      + statement {
          + actions   = [
              + "ssm:GetParameter",
            ]
          + resources = [
              + "arn:aws:ssm:ap-northeast-1:123456789012:parameter/notify-demo/api-key",
            ]
        }
      + statement {
          + actions   = [
              + "sns:Publish",
            ]
          + resources = [
              + (known after apply),
            ]
        }
    }

  # module.notify.data.aws_iam_policy_document.scheduler will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "scheduler" {
      + id            = (known after apply)
      + json          = (known after apply)
      + minified_json = (known after apply)

      + statement {
          + actions   = [
              + "lambda:InvokeFunction",
            ]
          + resources = [
              + (known after apply),
            ]
        }
    }

  # module.notify.aws_cloudwatch_log_group.fetch_status will be created
  + resource "aws_cloudwatch_log_group" "fetch_status" {
      + arn                         = (known after apply)
      + deletion_protection_enabled = (known after apply)
      + id                          = (known after apply)
      + log_group_class             = (known after apply)
      + name                        = "/aws/lambda/notify-demo-fetch-status"
      + name_prefix                 = (known after apply)
      + region                      = "ap-northeast-1"
      + retention_in_days           = 7
      + skip_destroy                = false
      + tags_all                    = (known after apply)
    }

  # module.notify.aws_cloudwatch_log_group.notify_slack will be created
  + resource "aws_cloudwatch_log_group" "notify_slack" {
      + arn                         = (known after apply)
      + deletion_protection_enabled = (known after apply)
      + id                          = (known after apply)
      + log_group_class             = (known after apply)
      + name                        = "/aws/lambda/notify-demo-notify-slack"
      + name_prefix                 = (known after apply)
      + region                      = "ap-northeast-1"
      + retention_in_days           = 7
      + skip_destroy                = false
      + tags_all                    = (known after apply)
    }

  # module.notify.aws_iam_role.fetch_status will be created
  + resource "aws_iam_role" "fetch_status" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "lambda.amazonaws.com"
                        }
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "notify-demo-fetch-status-role"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)

      + inline_policy (known after apply)
    }

  # module.notify.aws_iam_role.notify_slack will be created
  + resource "aws_iam_role" "notify_slack" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "lambda.amazonaws.com"
                        }
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "notify-demo-notify-slack-role"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)

      + inline_policy (known after apply)
    }

  # module.notify.aws_iam_role.scheduler will be created
  + resource "aws_iam_role" "scheduler" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Condition = {
                          + StringEquals = {
                              + "aws:SourceAccount" = "123456789012"
                            }
                        }
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "scheduler.amazonaws.com"
                        }
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "notify-demo-scheduler-role"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)

      + inline_policy (known after apply)
    }

  # module.notify.aws_iam_role_policy.fetch_status will be created
  + resource "aws_iam_role_policy" "fetch_status" {
      + id          = (known after apply)
      + name        = (known after apply)
      + name_prefix = (known after apply)
      + policy      = (known after apply)
      + role        = (known after apply)
    }

  # module.notify.aws_iam_role_policy.notify_slack will be created
  + resource "aws_iam_role_policy" "notify_slack" {
      + id          = (known after apply)
      + name        = (known after apply)
      + name_prefix = (known after apply)
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = "ssm:GetParameter"
                      + Effect   = "Allow"
                      + Resource = "arn:aws:ssm:ap-northeast-1:123456789012:parameter/notify-demo/slack-webhook-url"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + role        = (known after apply)
    }

  # module.notify.aws_iam_role_policy.scheduler will be created
  + resource "aws_iam_role_policy" "scheduler" {
      + id          = (known after apply)
      + name        = (known after apply)
      + name_prefix = (known after apply)
      + policy      = (known after apply)
      + role        = (known after apply)
    }

  # module.notify.aws_iam_role_policy_attachment.fetch_status_logs will be created
  + resource "aws_iam_role_policy_attachment" "fetch_status_logs" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
      + role       = "notify-demo-fetch-status-role"
    }

  # module.notify.aws_iam_role_policy_attachment.notify_slack_logs will be created
  + resource "aws_iam_role_policy_attachment" "notify_slack_logs" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
      + role       = "notify-demo-notify-slack-role"
    }

  # module.notify.aws_lambda_function.fetch_status will be created
  + resource "aws_lambda_function" "fetch_status" {
      + architectures                  = (known after apply)
      + arn                            = (known after apply)
      + code_sha256                    = (known after apply)
      + filename                       = "./build/fetch_status.zip"
      + function_name                  = "notify-demo-fetch-status"
      + handler                        = "app.handler"
      + id                             = (known after apply)
      + invoke_arn                     = (known after apply)
      + last_modified                  = (known after apply)
      + memory_size                    = 128
      + package_type                   = "Zip"
      + publish                        = false
      + qualified_arn                  = (known after apply)
      + qualified_invoke_arn           = (known after apply)
      + region                         = "ap-northeast-1"
      + reserved_concurrent_executions = -1
      + response_streaming_invoke_arn  = (known after apply)
      + role                           = (known after apply)
      + runtime                        = "python3.14"
      + signing_job_arn                = (known after apply)
      + signing_profile_version_arn    = (known after apply)
      + skip_destroy                   = false
      + source_code_hash               = "So5oKi3b/bEDekVIzzKxoKwo1aO2n/JdG+Ioj2nhtVw="
      + source_code_size               = (known after apply)
      + tags_all                       = (known after apply)
      + timeout                        = 30
      + version                        = (known after apply)

      + environment {
          + variables = (known after apply)
        }

      + ephemeral_storage (known after apply)

      + logging_config (known after apply)

      + tracing_config (known after apply)
    }

  # module.notify.aws_lambda_function.notify_slack will be created
  + resource "aws_lambda_function" "notify_slack" {
      + architectures                  = (known after apply)
      + arn                            = (known after apply)
      + code_sha256                    = (known after apply)
      + filename                       = "./build/notify_slack.zip"
      + function_name                  = "notify-demo-notify-slack"
      + handler                        = "app.handler"
      + id                             = (known after apply)
      + invoke_arn                     = (known after apply)
      + last_modified                  = (known after apply)
      + memory_size                    = 128
      + package_type                   = "Zip"
      + publish                        = false
      + qualified_arn                  = (known after apply)
      + qualified_invoke_arn           = (known after apply)
      + region                         = "ap-northeast-1"
      + reserved_concurrent_executions = -1
      + response_streaming_invoke_arn  = (known after apply)
      + role                           = (known after apply)
      + runtime                        = "python3.14"
      + signing_job_arn                = (known after apply)
      + signing_profile_version_arn    = (known after apply)
      + skip_destroy                   = false
      + source_code_hash               = "M+ENHhkFRJqThFhPFiREbrEpiqqEf0cJLzdvTNzrMUY="
      + source_code_size               = (known after apply)
      + tags_all                       = (known after apply)
      + timeout                        = 30
      + version                        = (known after apply)

      + environment {
          + variables = {
              + "TZ"                = "Asia/Tokyo"
              + "WEBHOOK_URL_PARAM" = "/notify-demo/slack-webhook-url"
            }
        }

      + ephemeral_storage (known after apply)

      + logging_config (known after apply)

      + tracing_config (known after apply)
    }

  # module.notify.aws_lambda_permission.notify_slack_from_sns will be created
  + resource "aws_lambda_permission" "notify_slack_from_sns" {
      + action              = "lambda:InvokeFunction"
      + function_name       = "notify-demo-notify-slack"
      + id                  = (known after apply)
      + principal           = "sns.amazonaws.com"
      + region              = "ap-northeast-1"
      + source_arn          = (known after apply)
      + statement_id        = "AllowExecutionFromSNS"
      + statement_id_prefix = (known after apply)
    }

  # module.notify.aws_scheduler_schedule.fetch_status will be created
  + resource "aws_scheduler_schedule" "fetch_status" {
      + action_after_completion      = (known after apply)
      + arn                          = (known after apply)
      + group_name                   = (known after apply)
      + id                           = (known after apply)
      + name                         = "notify-demo-fetch-status"
      + name_prefix                  = (known after apply)
      + region                       = "ap-northeast-1"
      + schedule_expression          = "rate(1 minute)"
      + schedule_expression_timezone = "UTC"
      + state                        = "ENABLED"

      + flexible_time_window {
          + mode = "OFF"
        }

      + target {
          + arn      = (known after apply)
          + input    = jsonencode(
                {
                  + source = "scheduler"
                }
            )
          + role_arn = (known after apply)
        }
    }

  # module.notify.aws_sns_topic.result will be created
  + resource "aws_sns_topic" "result" {
      + arn                         = (known after apply)
      + beginning_archive_time      = (known after apply)
      + content_based_deduplication = false
      + fifo_throughput_scope       = (known after apply)
      + fifo_topic                  = false
      + id                          = (known after apply)
      + maximum_message_size        = (known after apply)
      + name                        = "notify-demo-result"
      + name_prefix                 = (known after apply)
      + owner                       = (known after apply)
      + policy                      = (known after apply)
      + region                      = "ap-northeast-1"
      + signature_version           = (known after apply)
      + tags_all                    = (known after apply)
      + tracing_config              = (known after apply)
    }

  # module.notify.aws_sns_topic_subscription.result_to_notify_slack will be created
  + resource "aws_sns_topic_subscription" "result_to_notify_slack" {
      + arn                             = (known after apply)
      + confirmation_timeout_in_minutes = 1
      + confirmation_was_authenticated  = (known after apply)
      + endpoint                        = (known after apply)
      + endpoint_auto_confirms          = false
      + filter_policy_scope             = (known after apply)
      + id                              = (known after apply)
      + owner_id                        = (known after apply)
      + pending_confirmation            = (known after apply)
      + protocol                        = "lambda"
      + raw_message_delivery            = false
      + region                          = "ap-northeast-1"
      + topic_arn                       = (known after apply)
    }

Plan: 16 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + fetch_status_function_name = "notify-demo-fetch-status"

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

module.notify.aws_cloudwatch_log_group.fetch_status: Creating...
module.notify.aws_iam_role.fetch_status: Creating...
module.notify.aws_iam_role.notify_slack: Creating...
module.notify.aws_cloudwatch_log_group.notify_slack: Creating...
module.notify.aws_sns_topic.result: Creating...
module.notify.aws_iam_role.scheduler: Creating...
module.notify.aws_cloudwatch_log_group.fetch_status: Creation complete after 0s [id=/aws/lambda/notify-demo-fetch-status]
module.notify.aws_cloudwatch_log_group.notify_slack: Creation complete after 0s [id=/aws/lambda/notify-demo-notify-slack]
module.notify.aws_sns_topic.result: Creation complete after 0s [id=arn:aws:sns:ap-northeast-1:123456789012:notify-demo-result]
module.notify.data.aws_iam_policy_document.fetch_status: Reading...
module.notify.data.aws_iam_policy_document.fetch_status: Read complete after 0s [id=3535791877]
module.notify.aws_iam_role.notify_slack: Creation complete after 1s [id=notify-demo-notify-slack-role]
module.notify.aws_iam_role.scheduler: Creation complete after 1s [id=notify-demo-scheduler-role]
module.notify.aws_iam_role_policy_attachment.notify_slack_logs: Creating...
module.notify.aws_iam_role_policy.notify_slack: Creating...
module.notify.aws_lambda_function.notify_slack: Creating...
module.notify.aws_iam_role.fetch_status: Creation complete after 1s [id=notify-demo-fetch-status-role]
module.notify.aws_iam_role_policy_attachment.fetch_status_logs: Creating...
module.notify.aws_iam_role_policy.fetch_status: Creating...
module.notify.aws_lambda_function.fetch_status: Creating...
module.notify.aws_iam_role_policy_attachment.notify_slack_logs: Creation complete after 1s [id=notify-demo-notify-slack-role/arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole]
module.notify.aws_iam_role_policy_attachment.fetch_status_logs: Creation complete after 1s [id=notify-demo-fetch-status-role/arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole]
module.notify.aws_iam_role_policy.notify_slack: Creation complete after 1s [id=notify-demo-notify-slack-role:terraform-22dd2cc9194bee349a41b83b49]
module.notify.aws_iam_role_policy.fetch_status: Creation complete after 1s [id=notify-demo-fetch-status-role:terraform-70ee3cf4543eabb9406936afc3]
module.notify.aws_lambda_function.notify_slack: Still creating... [00m10s elapsed]
module.notify.aws_lambda_function.fetch_status: Still creating... [00m10s elapsed]
module.notify.aws_lambda_function.notify_slack: Creation complete after 15s [id=notify-demo-notify-slack]
module.notify.aws_lambda_permission.notify_slack_from_sns: Creating...
module.notify.aws_lambda_permission.notify_slack_from_sns: Creation complete after 0s [id=AllowExecutionFromSNS]
module.notify.aws_sns_topic_subscription.result_to_notify_slack: Creating...
module.notify.aws_sns_topic_subscription.result_to_notify_slack: Creation complete after 0s [id=arn:aws:sns:ap-northeast-1:123456789012:notify-demo-result:c13350e2-427f-446b-b1ff-341576727510]
module.notify.aws_lambda_function.fetch_status: Still creating... [00m20s elapsed]
module.notify.aws_lambda_function.fetch_status: Creation complete after 21s [id=notify-demo-fetch-status]
module.notify.data.aws_iam_policy_document.scheduler: Reading...
module.notify.data.aws_iam_policy_document.scheduler: Read complete after 0s [id=2990400390]
module.notify.aws_scheduler_schedule.fetch_status: Creating...
module.notify.aws_iam_role_policy.scheduler: Creating...
module.notify.aws_scheduler_schedule.fetch_status: Creation complete after 0s [id=default/notify-demo-fetch-status]
module.notify.aws_iam_role_policy.scheduler: Creation complete after 0s [id=notify-demo-scheduler-role:terraform-229c8ea50921716c957135f6a7]

Apply complete! Resources: 16 added, 0 changed, 0 destroyed.

Outputs:

fetch_status_function_name = "notify-demo-fetch-status"

I check the schedule with the CLI, as I did locally. The account ID is masked.

$ aws --region ap-northeast-1 scheduler list-schedules
{
    "Schedules": [
        {
            "Arn": "arn:aws:scheduler:ap-northeast-1:123456789012:schedule/default/notify-demo-fetch-status",
            "CreationDate": "2026-10-12T10:28:05.265000+09:00",
            "GroupName": "default",
            "LastModificationDate": "2026-10-12T10:28:05.265000+09:00",
            "Name": "notify-demo-fetch-status",
            "State": "ENABLED",
            "Target": {
                "Arn": "arn:aws:lambda:ap-northeast-1:123456789012:function:notify-demo-fetch-status"
            }
        }
    ]
}

Step 3: Verify the Behavior

After waiting about a minute from the first invocation, API status: ok is posted to #notify-demo-aws.

You can check the Lambda logs in CloudWatch Logs. In the console, open the log group, the log stream, and the log events in that order.

Summary

I built the pipeline from Scheduler through Lambda and SNS to Slack notifications locally with MiniStack. The Lambda code is shared with real AWS, and Terraform uses a shared module with one directory per environment, so the pipeline could be deployed to real AWS just by switching directories.
With StackPort, you can follow Lambda logs and SSM parameters on screen, which makes it easier to see what is going on than with the CLI alone.
That said, MiniStack and StackPort do not simulate AWS completely. For example, SecureString values are not encrypted, and StackPort cannot display Scheduler. I recommend understanding what you can test locally, and then verifying on real AWS as well.

Thank you for reading this far!

Why S3 list-buckets Returns a CreationDate That Doesn't Match the Actual Bucket Creation Date

Yoshiyuki Watanabe — Sat, 08 Aug 2026 00:18:03 +0000

Introduction

I manage multiple AWS accounts, and while taking inventory of S3 buckets and their creation dates across accounts with list-buckets, I noticed that the CreationDate returned by aws s3api list-buckets didn't match the actual bucket creation date shown in the S3 console.

I asked about this on AWS re:Post and got solid answers from the community.

Why does ListBuckets return incorrect CreationDate when called from a non-us-east-1 endpoint? | AWS re:Post

When I call `aws s3api list-buckets` from a regional endpoint other than `us-east-1` (e.g., `ap-northeast-1`), the `CreationDate` field returns an incorrect date that does not match the actual buck...

repost.aws

Digging further, I found a GitHub Issue on aws-cli with information about this exact issue.

This article cross-references the re:Post answers with that Issue to lay out the cause and the workaround.

The Symptom: CreationDate Changes When Called from a Non-us-east-1 Region

Calling list-buckets against the same bucket returns a different CreationDate depending on which regional endpoint you use.

# Called via the ap-northeast-1 endpoint
aws s3api list-buckets --region ap-northeast-1 \
  --query 'Buckets[?Name==`my-bucket`].CreationDate' --output text
# 2026-06-04T02:48:47+00:00

# Called via the us-east-1 endpoint
aws s3api list-buckets --region us-east-1 \
  --query 'Buckets[?Name==`my-bucket`].CreationDate' --output text
# 2023-07-05T08:39:18+00:00

This bucket was created in ap-northeast-1, and the S3 console shows its creation date as July 5, 2023, 17:39:18 (UTC+09:00).

In other words, the us-east-1 result matches the console, while only the ap-northeast-1 result is off from the actual creation date.

The Cause: CreationDate Isn't the "Creation Date" — It's the "Last Replication Time in That Region"

The investigation revealed that the meaning of the CreationDate returned by list-buckets depends on which regional endpoint you call it from.

All S3 bucket creation operations appear to be mastered in us-east-1 and then replicated globally.

When you call list-buckets against an endpoint other than us-east-1, the CreationDate you get back isn't the actual creation date — it's the last replication time for that region (i.e., the timestamp of the most recent sync, such as a bucket policy change).

Only when you call the us-east-1 endpoint do you get the original creation date registered at the master. The S3 console also reads from the us-east-1 data, which is why the console date always matches the us-east-1 endpoint's result.

The aws-cli GitHub Issue includes the following explanation:

All bucket creations are mastered in us-east-1, then replicated on a global scale - the resulting difference is that there are no "replication" events to the us-east-1 region.

When using an endpoint other than us-east-1, the CreationDate you receive is actually the last modified time according to the bucket's last replication time in this region. This date can change when making changes to your bucket, such as editing its bucket policy.

Source: aws/aws-cli#3597

The official AWS documentation for the Bucket data type's CreationDate field also includes this line:

Date the bucket was created. This date can change when making changes to your bucket, such as editing its bucket policy.

Source: Amazon S3 API Reference - Bucket

However, this sentence alone doesn't make it clear that the behavior varies by region — it's an easy detail for many users to miss.

I confirmed this myself: after editing a bucket policy, only the CreationDate returned via the ap-northeast-1 endpoint changed. Changing Block public access produced the same result.

It seems any bucket-level configuration change — not just bucket policy edits — can trigger this replication timestamp update.

# After the configuration change
aws s3api list-buckets --region ap-northeast-1 \
  --query 'Buckets[?Name==`my-bucket`].CreationDate' --output text
# 2026-08-06T21:20:49+00:00

aws s3api list-buckets --region us-east-1 \
  --query 'Buckets[?Name==`my-bucket`].CreationDate' --output text
# 2023-07-05T08:39:18+00:00

The Workaround: Explicitly Specify the us-east-1 Endpoint

To get the accurate creation date, explicitly call the API with --region us-east-1.

aws s3api list-buckets --region us-east-1 \
  --query 'Buckets[?Name==`my-bucket`].CreationDate' --output text

This result matches the creation date shown in the S3 console.

Conclusion

The CreationDate returned by list-buckets has a quirk: calling it from any endpoint other than us-east-1 returns the last replication time for that region, not the actual bucket creation date.

If you need the accurate creation date, explicitly specify --region us-east-1.

I lost some time myself before figuring this out. I hope this article saves someone else from the same trap.

Thank you for reading this far!

DEV Community: Yoshiyuki Watanabe

Trying MiniStack and StackPort

Introduction

ministackorg / ministack

Ministack: Free, open-source local AWS emulator - 60+ services, Terraform compatible, real databases. Free forever. MIT licensed.

MiniStack

Why MiniStack?

DaviReisVieira / stackport

Open-source universal AWS resource browser for MiniStack, Floci, LocalStack, Moto, and real AWS

StackPort

Screenshots

Features

What Are MiniStack and StackPort?

MiniStack

MiniStack — The Best AWS Emulator | Free Open-Source LocalStack Alternative

StackPort

StackPort: open-source web console for AWS emulators

Architecture

Building the Local Environment

Step 1: Start MiniStack, StackPort, and the Mock Server

Step 2: Register SecureString Parameters in SSM Parameter Store

Step 3: Write the Lambda Code

Step 4: Create the Resources with Terraform

Step 5: Verify the Behavior

Deploying to Real AWS and Verifying the Same Behavior

Step 1: Register the SSM Parameters

Step 2: Deploy

Step 3: Verify the Behavior

Summary

Why S3 list-buckets Returns a CreationDate That Doesn't Match the Actual Bucket Creation Date

Introduction

Why does ListBuckets return incorrect CreationDate when called from a non-us-east-1 endpoint? | AWS re:Post

The Symptom: CreationDate Changes When Called from a Non-us-east-1 Region

The Cause: CreationDate Isn't the "Creation Date" — It's the "Last Replication Time in That Region"

The Workaround: Explicitly Specify the us-east-1 Endpoint

Conclusion