v1.5.6

What's Changed

[1.5.6] — 2026-09-02

Added

• Amazon Transcribe (transcribe) — new service emulator for batch transcription jobs: StartTranscriptionJob, GetTranscriptionJob, ListTranscriptionJobs, DeleteTranscriptionJob, verified against botocore transcribe-2017-10-26. Jobs walk QUEUED → IN_PROGRESS → COMPLETED (paced by TRANSCRIBE_JOB_RUN_SECONDS), read their media from MiniStack S3 by s3://, path-style or virtual-hosted URI, and write the transcript back to S3 in the real result format, with IdentifyLanguage/IdentifyMultipleLanguages, ContentRedaction, Subtitles and speaker labels honoured and a Transcribe Job State Change event published on the default bus at terminal states. The transcript is deterministic canned text — there is no speech recognition. Streaming, call-analytics and medical jobs, custom vocabularies and tagging are not implemented. Contributed by @ppettitau.
• Lambda — SnapStart — the SnapStart parameter on CreateFunction and UpdateFunctionConfiguration was silently swallowed, so a deployment that enables it saw permanent Terraform drift. It now round-trips: $LATEST echoes ApplyOn with OptimizationStatus: Off, a published version reports On and walks Pending → Active, and the documented constraints are enforced — Java 11+/Python 3.12+/.NET 8+ zip runtimes only (container images accepted), no ephemeral storage above 512 MB, refused with InvalidParameterValueException. The mechanism is emulated, not just the shape: publishing initializes the version's execution environment right then (warm worker or RIE container), so the first invoke is warm, invoking while Pending answers ResourceConflictException, a broken init fails the publish (State: Failed), and snapshot-restore-py before-snapshot/after-restore hooks run during a published version's init. No snapshot exists locally; Java CRaC and .NET hooks do not fire.
• RDS — MySQL writer quiescence primitives — writer-fence verification, transaction/XA drain inventory and fenced GTID capture for Aurora MySQL global-cluster switchover, deadline-bounded and fail-closed; dormant until a switchover orchestrator calls them. Contributed by @Areson.
• Glue / S3 Tables — Iceberg-Spark catalog for Glue 5.0 — jobs declaring GlueVersion 5.0 resolve the Iceberg-Spark catalog, covering the dispatch and parse differences between Spark 3.5 and 3.3 and Iceberg v3, and the embedded Iceberg REST catalog now serves clients beyond DuckDB and Spark: createNamespace is routed instead of answering an internal error, and the pyiceberg-visible defects (format-version, unresolved schema-id) are fixed. Reported by @kevinprince.

Fixed

• ALB — the authenticate-oidc listener action authenticates — the action's config was accepted and discarded, so every request reached the target unauthenticated. The documented flow now runs end to end: redirect to the AuthorizationEndpoint, code exchange at the TokenEndpoint, claims from the UserInfoEndpoint, session in sharded AWSELBAuthSessionCookie cookies, and targets receive x-amzn-oidc-identity, x-amzn-oidc-accesstoken and x-amzn-oidc-data — the last as AWS's signed ES256 JWT (kid, signer, iss, client, exp; base64 segments padded, as ALB emits them) with client-supplied copies stripped. Rule actions now run as a chain in Order, and ModifyListener updates the default rule the data plane serves. authenticate-cognito answers 501. Contributed by @dhanesh.
• Router — an unregistered Host is no longer routed by service-token substring — the host-pattern step ran unanchored iot\., logs\., email\. regexes over any unclassified Host, so probe.iot.example.com answered Unsupported IoT path and logs.example.com landed in CloudWatch Logs. Host patterns are now consulted only for hosts the stack serves — a single label, a two-label alias, an IP literal, or a name under localhost, amazonaws.com, MINISTACK_HOST or the container hostname, matched at a label boundary — and each service token is anchored at a label start, so probe-iot.localhost is not IoT while <bucket>.s3.<region>, <api-id>.execute-api.<region> and the other AWS shapes route exactly as before. Contributed by @iot-rocket.
• IAM — the AWS-managed policies a CDK, SAM or Serverless deployment attaches resolve by their real ARNs — the seeded catalogue filed the Lambda execution-role policies under arn:aws:iam::aws:policy/<Name> while AWS publishes them under …:policy/service-role/<Name>, the only ARN those tools emit, so GetPolicy answered NoSuchEntity and under AUTH=true an attached policy granted nothing. The catalogue now carries them under their real path with the documents from the AWS Managed Policy Reference, reports PolicyName and Path as AWS does, and adds the missing CDK/API Gateway/IoT and SQS/Kinesis/DynamoDB execution-role policies. The path-less spellings answer NoSuchEntity, as on AWS. Contributed by @iot-rocket.
• IAM enforcement — the aws:ResourceAccount condition key resolves — with AUTH=true a statement conditioned on aws:ResourceAccount (or s3:ResourceAccount) never matched, so CDK's own bootstrap template failed asset publishing. The key resolves to the resource-owning account (the ARN's account field wins); a condition naming another account still denies, and every other unknown key keeps denying. Contributed by @iot-rocket.
• IAM enforcement — S3 multipart uploads authorize as s3:PutObject — CreateMultipartUpload was checked as a literal action no policy grants, so every upload above the SDK's multipart threshold was denied. The multipart operations now map to the actions S3 documents (s3:PutObject, s3:AbortMultipartUpload, the two listing actions), ?versions is s3:ListBucketVersions, object-level ?tagging/?acl use the object actions, and configuration DELETEs authorize as their Put* action. Contributed by @iot-rocket.
• Lambda — a failed Docker cold start no longer leaks its extraction directory — anything raised between unpacking the code/layers and the container start (a corrupt layer zip, a Docker socket read-timeout) orphaned a full ministack-lambda-docker-* tree, compounding to gigabytes under Docker-API pressure. Cleanup now covers every exit until the container is handed to the warm pool. Reported by @iot-rocket.
• RDS — a container worker no longer clobbers an intervened stop — StopDBInstance landing while the background worker was still starting the instance's container was undone when the worker finished and set the status back to available; the worker now finishes without overwriting a stop, so DBInstanceStatus and DB-proxy TargetHealth stay stopped/UNAVAILABLE.