What landed in MiniStack between 1.2.0 and 1.3.30

MiniStack 1.3.30 is out — here's what shipped recently

MiniStack is a free, MIT-licensed local AWS emulator. Single binary, 55+ services, runs on your laptop or in CI in under a second. No login, no token, no per-seat fee.

GitHub: https://github.com/ministackorg/ministack
Docs: https://ministack.org/docs/

Highlights since 1.3.20

Step Functions aws-sdk:s3 integrations. arn:aws:states:::aws-sdk:s3:listObjectsV2 and 11 other S3 operations now work as native Step Functions SDK integrations: ListBuckets, CreateBucket, DeleteBucket, HeadBucket, GetBucketVersioning, ListObjectsV2, ListObjects, HeadObject, CopyObject, DeleteObject, GetObjectTagging, PutObjectTagging. REST-JSON output also moved to PascalCase to match the rest of the dispatcher, so ResultSelector: $.Records resolves cleanly on aws-sdk:rdsdata:executeStatement.

EC2 DescribeVpcEndpointServices. Returns the standard catalog of 2 Gateway services (s3, dynamodb) and 17 Interface PrivateLink services with region-templated DNS names. ServiceNames, service-name, and service-type filters supported.

DynamoDB legacy parameters. Expected, KeyConditions, ScanFilter, QueryFilter, and AttributeUpdates all work now. The .NET AWS SDK was silently dropping non-key fields on every UpdateItem because it speaks the legacy attribute API under the hood. Fixed.

ECS Task Metadata V4. Every container started by RunTask now gets ECS_CONTAINER_METADATA_URI_V4 injected. The gateway serves /v4/<token>, /v4/<token>/task, and the /stats endpoints. RunTask also translates privileged, linuxParameters.capabilities.add, pidMode: host, and volumes + mountPoints into Docker bind mounts.

AWS CloudTrail. New service. In-memory audit log, opt in via CLOUDTRAIL_RECORDING=1. Per-account ring buffer with LookupEvents covering all eight LookupAttributes. Full control plane: CreateTrail, DeleteTrail, Get/DescribeTrails, StartLogging/StopLogging with real IsLogging state, Put/GetEventSelectors, tag ops.

AWS Resource Groups. New service, 19 of 23 spec operations. Group CRUD, resource queries, configuration, membership, tagging, account settings.

CloudFormation AWS::CloudFront::KeyValueStore. Create / Update / Delete with Arn, Id, Status exposed via Fn::GetAtt. The CFN engine now routes previously-provisioned resources through a per-type update handler when one is defined.

OpenSearch non-VPC domains. VPCOptions is now omitted on non-VPC domains instead of returning an empty object, which was causing the Terraform AWS provider to misclassify them as VPC-backed and fail with OpenSearch Domain in VPC expected to have null Endpoint value.

API Gateway v1 fixes. GetUsagePlanKey handler added (Terraform's aws_api_gateway_usage_plan_key apply was aborting without it). HTTP_PROXY integrations now do path-parameter substitution from integration.request.path.X = method.request.path.X mappings and forward the query string. UpdateModel handler added.

Step Functions REST-JSON casing. Successful REST-JSON integrations like aws-sdk:rdsdata:executeStatement now expose output keys in PascalCase (Records, NumberOfRecordsUpdated) instead of raw camelCase, matching query and REST-XML dispatchers.

SQS ReceiveMessage honours MessageSystemAttributeNames. Only the deprecated AttributeNames was being read, so AWS SDK v2 (Java, Kotlin) consumers were getting empty Attributes and broken ApproximateReceiveCount-based redelivery detection.

SFN aws-sdk:ec2 security group compatibility. CreateSecurityGroup now maps SDK Description to wire GroupDescription, DescribeSecurityGroups sends EC2-shaped filters (Filter.1.Value.1 instead of member.N), and the XML adapter returns SecurityGroups rather than raw SecurityGroupInfo.

CFN AWS::SNS::Subscription honours RawMessageDelivery. The provisioner was silently defaulting to false even when templates set true, so consumers got SNS-wrapped envelopes instead of raw payloads.

Wire-format parity (what makes the project worth using)

• All JSON timestamps are int epoch seconds. Java SDK v2 rejects floats. STS Credentials.Expiration, EventBridge Time, EKS createdAt, CloudTrail EventTime, Backup, Firehose — all converted.
• KMS Verify raises KMSInvalidSignatureException on bad signatures instead of returning SignatureValid: false with HTTP 200.
• KMS crypto operations return the full key ARN as KeyId, not the bare UUID.
• DynamoDB ConditionalCheckFailedException populates Item when ReturnValuesOnConditionCheckFailure="ALL_OLD" is set, on Put/Update/Delete/TransactWriteItems.
• EC2 VPCs include cidrBlockAssociationSet (Terraform AWS provider v6 crashes without it).
• SQS FIFO DeduplicationScope: messageGroup actually scopes per message group.

Try it

docker run --rm -p 4566:4566 ministackorg/ministack:1.3.30

Or pip:

pip install ministack
ministack

Point AWS CLI / boto3 / Terraform at http://localhost:4566 with any non-empty access key.

GitHub: https://github.com/ministackorg/ministack
Docs: https://ministack.org/docs/
LinkedIn: https://www.linkedin.com/company/ministackorg/
Reddit: https://www.reddit.com/r/ministack/

If something is missing or wrong, open an issue.