Parity matrix
Service-by-service behavior parity: what is real, what is synthesized, and what is not yet implemented.
fakecloud implements 105 AWS services with 7,391 operations. 248,319/248,319 generated Smithy conformance variants pass on every commit — true 100% across every implemented service, no flake margin and no skipped services. Conformance checks request/response shapes, field names, and error codes against AWS's own Smithy models. Behavior parity varies by service — some run real infrastructure (Postgres, Redis, Docker containers), some run a real control plane but return synthesized data for complex queries, and a few have control-plane-only coverage with no data-plane enforcement.
| Service | Ops | Protocol | Control plane | Data plane | Known limitations |
|---|---|---|---|---|---|
| S3 | 107 | REST-XML | Full | Full | SelectObjectContent returns real EventStream chunks. WriteGetObjectResponse stores body + metadata. Access points include data-plane routing. PublicAccessBlock.IgnorePublicAcls is enforced on GetObject. Object Lock compliance mode is enforced on single-object delete but not yet on batch delete. Multi-region access points are control-plane only. |
| SQS | 23 | JSON 1.1 (Query) | Full | Full | — |
| SNS | 42 | JSON 1.1 (Query) | Full | Full | Email subscriptions deliver via SMTP relay when FAKECLOUD_SMTP_RELAY_* env is configured; otherwise they land in the introspection ledger. |
| EventBridge | 57 | JSON 1.1 | Full | Full | — |
| EventBridge Scheduler | 12 | JSON 1.1 | Full | Full | — |
| EventBridge Pipes | 10 | REST-JSON | Full | Full | Source (SQS/Kinesis/DynamoDB Streams) -> optional filter -> optional Lambda enrichment -> target (Lambda/SQS/SNS/Step Functions/EventBridge bus/Kinesis), with per-target InputTemplate transform, all driven by a real background runner. |
| Lambda | 70 | REST-JSON | Full | Full | UpdateFunctionCode fetches real bytes from S3 and recomputes CodeSha256. Reserved concurrency is recorded but not yet enforced at invoke time. Provisioned concurrency is a roadmap item. |
| DynamoDB | 57 | JSON 1.1 | Full | Full | — |
| IAM | 176 | JSON 1.1 (Query) | Full | Full | — |
| STS | 11 | JSON 1.1 (Query) | Full | Full | — |
| SSM | 152 | JSON 1.1 | Full | Partial | StartSession returns the model's TargetNotConnected and ResumeSession returns DoesNotExistException with a documentation pointer rather than opening a real websocket. Session Manager data plane is not implemented. |
| Secrets Manager | 23 | JSON 1.1 | Full | Full | — |
| CloudWatch Logs | 118 | JSON 1.1 | Full | Full | StartLiveTail returns streamed results with real GetLogObject pointer resolution. GetLogFields persists and aggregates JSON keys observed across the source's events. Delivery configuration persists with standard AWS templates. Log event export to S3 and Firehose is real. Metric filters extract metrics from ingested logs. |
| KMS | 53 | JSON 1.1 | Full | Full | Real ECDSA P-256, P-384, and P-521 signing. |
| CloudFormation | 90 | JSON 1.1 (Query) | Full | Full | Custom resources execute real Lambda-backed custom resource providers. |
| Cloud Control API | 8 | JSON 1.0 | Full | Full | CreateResource, UpdateResource, and DeleteResource drive the same CloudFormation resource provisioners (including container-backed resources), so a resource created through Cloud Control is real, not a parallel fake. UpdateResource applies the full RFC 6902 JSON Patch operation set (add/remove/replace/move/copy/test) to desired state. ClientToken idempotency replays the original terminal ProgressEvent. Request tracking (GetResourceRequestStatus, ListResourceRequests, CancelResourceRequest) records every mutating request. State is account-partitioned and persists across restarts in persistent mode. |
| SES | 112 | JSON 1.1 | Full | Full | v2 sending + v1 inbound receipt rules are both real. DKIM signing is real. GetMessageInsights returns real delivery tracking data. Bounce simulator addresses are available for testing. SMTP credential issuance is implemented via IAM service-specific credentials, and an opt-in SMTP submission listener (FAKECLOUD_SES_SMTP_PORT) accepts mail authenticated with those credentials. Outbound SMTP relay is supported when FAKECLOUD_SMTP_RELAY_* env is configured. |
| Cognito User Pools | 129 | JSON 1.1 | Full | Full | Real RSA-2048 RS256 JWT signing. JWKS + OIDC discovery endpoints serve real JWKs. /oauth2/token, /oauth2/authorize, /oauth2/userInfo, and /oauth2/revoke are all implemented. Refresh token rotation is supported when enabled. PreTokenGeneration trigger invokes the configured Lambda and merges claims. CompromisedCredentialsRiskConfiguration is enforced. WebAuthn packed attestation format is verified. GetSigningCertificate returns real X.509 certificates. |
| Cognito Identity | 23 | JSON 1.1 | Full | Full | Identity pools, federated identities, developer identities, and real STS-style credential issuance are implemented. |
| Kinesis | 39 | JSON 1.1 | Full | Full | — |
| RDS | 163 | JSON 1.1 (Query) | Full | Full | Real Postgres, MySQL, MariaDB, Oracle, SQL Server, and Db2 via Docker. PostgreSQL aws_lambda + aws_s3 extensions and Aurora-compatible MySQL/MariaDB mysql.lambda_async/mysql.lambda_sync invoke fakecloud Lambda and import/export S3 objects from SQL. |
| DocumentDB | 55 | Query (XML) | Full | None | RDS-shaped Query API served on the shared rds SigV4 scope (the DocumentDB SDK is disambiguated from RDS by its api/docdb user-agent token). Full 55-op control plane: DB clusters (writer + reader endpoints, cluster-XXXX resource ids, ARNs), instances that attach to a cluster as writer/reader members, cluster snapshots with copy / restore-from-snapshot / point-in-time restore, cluster parameter groups (values round-trip), subnet groups, global clusters, event subscriptions, pending-maintenance / certificate / engine-version / orderable-option catalog ops, and tagging. Account-partitioned and persisted. No data plane: fakecloud ships no MongoDB-compatible DocumentDB engine image (unlike RDS's real Postgres containers), so clusters and instances are control-plane records with well-formed endpoints that accept no wire connections. |
| Neptune | 70 | Query (XML) | Full | None | RDS-shaped Query API served on the shared rds SigV4 scope (the Neptune SDK is disambiguated from RDS by its api/neptune user-agent token). Full 70-op control plane: DB clusters (writer + reader endpoints, cluster-XXXX resource ids, ARNs, promote-read-replica), instances that attach to a cluster as writer/reader members, custom/reader cluster endpoints, IAM role associations, cluster snapshots with copy / restore-from-snapshot / point-in-time restore, cluster + DB parameter groups (values round-trip), subnet groups, global clusters, event subscriptions, pending-maintenance / engine-version / orderable-option catalog ops, and tagging. Account-partitioned and persisted. No data plane: fakecloud ships no Neptune (Gremlin/SPARQL) graph engine image (unlike RDS's real Postgres containers), so clusters and instances are control-plane records with well-formed endpoints that accept no wire connections. |
| RDS Data API | 6 | REST-JSON | Full | Full | ExecuteStatement and BatchExecuteStatement run real SQL on the backing Postgres/MySQL container with typed parameters and results (including bytea/BLOB), and BeginTransaction/CommitTransaction/RollbackTransaction hold a real connection open across calls. Requires the resourceArn to resolve to a running RDS instance. The deprecated ExecuteSql (removed from the public API) returns BadRequestException. |
| Redshift | 141 | Query (XML) | Full | None | Full control plane: clusters, snapshots (with real SnapshotArn), parameter groups (with Source=user filtering), subnet/security groups, HSM objects, snapshot copy grants/schedules (and cluster associations), event subscriptions, usage limits, cross-region snapshot-copy config, per-cluster logging, endpoint access (with a synthesized interface VPC endpoint), authentication profiles, IAM-role attach, and partner registration. New clusters progress straight to available and report a synthetic Endpoint. No SQL data plane (that is the separate redshift-data API); data sharing and zero-ETL integrations that require Redshift Serverless are out of scope. |
| Amazon Timestream | 30 | JSON 1.0 | Full | Query engine (subset) | One crate serves BOTH the Timestream Write and Timestream Query SDK clients — they share the Timestream_20181101.<Op> awsJson1_0 target prefix and a single account-partitioned store, so databases/tables created on the write side are read back by Query. 30 distinct ops (19 write + 15 query, four shared): databases (Create/Describe/List/Update/Delete, database/<name> ARNs, KmsKeyId, TableCount; deleting a non-empty database is a ValidationException), tables (RetentionProperties/MagneticStoreWriteProperties/Schema echoed, status ACTIVE, database/<db>/table/<name> ARNs, ListTables filtered by database), WriteRecords (validates dimensions/measure/time, merges CommonAttributes, stores points in a bounded per-table buffer, returns RecordsIngested; malformed records come back as RejectedRecords in a RejectedRecordsException), Query/PrepareQuery/CancelQuery, scheduled queries (Create/Describe/List/Update/Delete/ExecuteScheduledQuery), batch-load tasks (Create/Describe/List/Resume), account settings (Describe/Update, MaxQueryTCU/QueryPricingModel), DescribeEndpoints (returns the fakecloud host so a real SDK's endpoint-discovery step resolves back to fakecloud), and ARN-keyed tagging. Model-driven required/length/range/enum validation with the declared exceptions (ValidationException/ResourceNotFoundException/ConflictException/RejectedRecordsException/ThrottlingException/AccessDeniedException/InternalServerException/ServiceQuotaExceededException/InvalidEndpointException). Account-partitioned and persisted. Honest gap: the Query SQL engine is a real, bounded interpreter — SELECT * and SELECT COUNT(*) over "db"."table", WHERE time <op> ago(<n><unit>), ORDER BY time, LIMIT — returning ingested points as rows with AWS-shaped ColumnInfo/Datum typing; shapes beyond that subset return a ValidationException naming the unsupported construct rather than a wrong/empty success, and there is no real time-series storage engine underneath. |
| AWS IoT Data Plane | 11 | REST-JSON | Full | Shadows + retained store | Full 11-op AWS IoT Data Plane device-shadow + retained-message data plane, signed as iotdata and routed by HTTP method plus @http URI path. Device shadows (classic + named): UpdateThingShadow (POST /things/{thingName}/shadow, optional ?name=) accepts a shadow document as the raw @httpPayload body and deep-merges state.desired/state.reported into the stored shadow (a null leaf deletes that key, matching AWS), bumps version, stamps per-leaf metadata timestamps, and recomputes state.delta (the subset of desired differing from reported); GetThingShadow returns the full merged document (state/metadata/version/timestamp); DeleteThingShadow removes it and returns the deletion payload; ListNamedShadowsForThing paginates a thing's named-shadow names with a round-tripping nextToken. A supplied shadow version that does not match the stored one is rejected with ConflictException; a missing shadow is ResourceNotFoundException. Publish (POST /topics/{topic}, ?qos=/?retain=) stores retained messages (an empty retained payload clears the topic) and accepts non-retained publishes as a 200 no-op; GetRetainedMessage/ListRetainedMessages read them back (payload byte-for-byte, qos, lastModifiedTime). Model-derived validation (thingName/shadowName length + pattern, qos range, payloadFormatIndicator enum, shadow-document shape) with each op's declared InvalidRequestException/ResourceNotFoundException/ConflictException; account-partitioned and persisted. Honest gaps: fakecloud runs no MQTT broker, so Publish is stored (when retained) but never fanned out to live subscribers, and because no client is ever connected the connection-introspection ops (GetConnection/DeleteConnection/ListSubscriptions/SendDirectMessage) faithfully return ResourceNotFoundException for every client id -- the AWS-correct response for an unknown connection. |
| Amazon Pinpoint | 122 | REST-JSON | Full | Control plane | Complete 122-op Amazon Pinpoint control plane (signs as mobiletargeting, routed by HTTP method + @http URI path under /v1): apps (CreateApp mints a 32-hex id + arn:aws:mobiletargeting:<region>:<account>:apps/<id> ARN; GetApp/GetApps/DeleteApp; Get/UpdateApplicationSettings); versioned campaigns + segments (each Update bumps Version and is listed by GetCampaignVersions/GetSegmentVersions + the by-version reads; CreateSegment derives SegmentType IMPORT-vs-DIMENSIONAL; GetCampaignActivities/GetSegment{Import,Export}Jobs); endpoints + users (per-(appId,endpointId) storage, UpdateEndpointsBatch, Get/DeleteUserEndpoints over a shared User.UserId, RemoveAttributes); all platform channels (ADM, APNS + sandbox/VoIP/VoIP-sandbox, Baidu, Email, GCM, SMS, Voice — Get/Update/Delete echoing Platform + Enabled, plus GetChannels); journeys (DRAFT -> ACTIVE state machine via UpdateJourneyState, GetJourneyRuns); email/push/sms/voice/inapp templates (versioned, UpdateTemplateActiveVersion, ListTemplates/ListTemplateVersions); import/export jobs (mint a JobId, settle to COMPLETED); event streams (Put/Get/DeleteEventStream); recommender configurations; and ARN-keyed tags. Model-derived required/label validation with Pinpoint's declared exceptions (BadRequestException/NotFoundException/ConflictException/ForbiddenException/TooManyRequestsException/PayloadTooLargeException/MethodNotAllowedException/InternalServerErrorException); account-partitioned and persisted. Honest gaps: no real delivery (SendMessages/SendUsersMessages/SendOTPMessage/PutEvents/VerifyOTPMessage validate + return a structurally-correct MessageResponse with a per-address delivery status but transmit nothing), the KPI / execution-metric reads return empty/zeroed metric result sets (no analytics engine), and import/export jobs do not read or write S3. |
| AWS IoT Core | 272 | REST-JSON | Full | Registry/jobs/rules/security control plane | Full 272-op AWS IoT Core control plane, signed as iot and routed by HTTP method plus @http URI path. The route table, per-operation HTTP bindings, model-derived input constraints, and output member shapes are all generated from AWS's Smithy model. Every modelled resource family mints proper ARNs + ids, persists its attributes, and round-trips on read/list with paginating nextTokens: things / thing types / thing groups (static + dynamic) / billing groups (with membership via AddThingToThingGroup / AddThingToBillingGroup), policies (+ versions + default version + v2 AttachPolicy/ListAttachedPolicies/ListTargetsForPolicy and legacy AttachPrincipalPolicy/ListPrincipalPolicies attachments), certificates (CreateKeysAndCertificate/CreateCertificateFromCsr mint a 64-hex id + ARN + structurally-shaped PEM + RSA key pair; RegisterCertificate/RegisterCACertificate; AttachThingPrincipal/ListThingPrincipals), jobs + job templates, topic rules + destinations (SQL + actions stored verbatim; Enable/Disable flip the disabled flag), Device Defender (security profiles, scheduled audits, account audit configuration, mitigation actions, custom metrics, dimensions), provisioning templates (+ versions), domain configurations, fleet metrics, role aliases, authorizers (+ default authorizer), streams, OTA updates, packages (+ versions), certificate providers, commands, DescribeEndpoint (deterministic per-account host per endpoint type), and ARN-keyed tagging. Model-derived required/length/range/enum validation with each op's declared exceptions (ResourceNotFoundException/InvalidRequestException/ResourceAlreadyExistsException/VersionConflictException/DeleteConflictException/...). Account-partitioned and persisted. Honest gaps: no live MQTT broker or device connectivity -- the control plane is real but no message is routed, no topic-rule action executes against a real target, and no device attaches over MQTT (the device data plane lives in the separate iotdata service); SearchIndex + aggregation ops run against the in-memory thing registry with a bounded query subset (*, thingName:<name>, bare name), returning InvalidQueryException for anything else rather than a wrong result; certificates are structurally-valid PEM placeholders, not real CA-signed X.509 chains. |
| AWS IoT Wireless | 112 | REST-JSON | Full | LoRaWAN/Sidewalk registry control plane | Full 112-op AWS IoT Wireless control plane, signed as iotwireless and routed by HTTP method plus @http URI path. The route table, per-operation HTTP bindings, model-derived input constraints, and output member shapes are all generated from AWS's Smithy model. Unlike AWS IoT Core, IoT Wireless models every create as a collection POST with the new resource's identifier in the response, so families whose create output carries an Id mint a UUID-shaped id (device profiles, service profiles, FUOTA tasks, multicast groups, wireless devices, wireless gateways, task definitions) while the two name-addressed families (destinations, network-analyzer configurations) key off the required body Name. Every named resource mints proper ARNs + ids, persists its attributes, and round-trips on read/list/update with paginating NextTokens: destinations, device/service profiles, FUOTA tasks, multicast groups, wireless devices + gateways, network-analyzer configurations, wireless-gateway task definitions, position configurations (Put/Get), and resource positions (raw GeoJSON @httpPayload blob). ARN-keyed tagging (TagResource/ListTagsForResource/UntagResource). Model-derived required/length/range/enum validation (including required @httpPayload) with each op's declared exceptions (ValidationException/ResourceNotFoundException/ConflictException/...). Account-partitioned and persisted. Honest gaps: no live LoRaWAN/Sidewalk radio plane -- the control plane is real but no device transmits, no downlink is delivered (SendDataToWirelessDevice/SendDataToMulticastGroup), no FUOTA image is fragmented, and no gateway task runs; association/session operations are accepted (and persisted where addressed by a stored resource) but drive no radio behaviour. |
| Amazon SageMaker | 403 | JSON 1.1 | Full | Control-plane only | Full 403-op Amazon SageMaker control plane, signed as sagemaker and routed by the X-Amz-Target: SageMaker.<Op> header (awsJson1.1, all inputs in the JSON body). The operation table, model-derived input constraints, output member shapes, list element shapes, and each op's resource family + identifier member are all generated from AWS's Smithy model (scripts/generate-sagemaker-tables.py). A single uniform engine serves all ~130 resource families: Create<X> mints an arn:aws:sagemaker:...:<kind>/<name> ARN + numeric CreationTime/LastModifiedTime, persists every accepted input field and returns <X>Arn; Describe<X> echoes the persisted record; List<X>s projects each record onto its <X>Summary with paginating NextTokens; Update<X> merges + refreshes LastModifiedTime; Delete<X> is idempotent. Covers models, endpoint configs, endpoints, training/processing/transform/labeling/compilation/AutoML(v1+v2)/hyper-parameter-tuning jobs, model packages (+ groups), pipelines, feature groups, domains, user profiles, spaces, apps, images (+ versions), experiments, trials (+ components), actions, artifacts, contexts, clusters, inference components, monitoring schedules, notebook instances (+ lifecycle configs), code repositories, workteams, and workforces. ARN-keyed tagging (AddTags/ListTags/DeleteTags). Model-derived required/length/range/enum validation returning SageMaker's ValidationException; missing resource -> ResourceNotFound, duplicate create -> ResourceInUse. Account-partitioned and persisted. Honest gaps: control plane only -- there is no ML execution plane; training/processing/transform/AutoML/tuning jobs are created, persisted, and described but no container is scheduled, no model is trained, and no inference endpoint serves traffic; jobs and endpoints are not advanced through a live lifecycle by a background scheduler; presigned-URL and lineage/search query operations are accepted as control-plane no-ops. |
| Resource Groups | 23 | REST-JSON | Full | Partial | Full 23-op control plane: group lifecycle (Create/Get/Update/Delete/ListGroups), resource queries (TAG_FILTERS_1_0 / CLOUDFORMATION_STACK_1_0) via GetGroupQuery/UpdateGroupQuery, explicit membership (GroupResources/UngroupResources/ListGroupResources), group configuration, tagging (Tag/Untag/GetTags), account settings, grouping statuses, and tag-sync tasks. arn:aws:resource-groups:...:group/<name>/<id> ARNs, account-partitioned and persisted. Query-based membership resolution (evaluating a tag/CloudFormation-stack query against live resources) depends on the cross-service tag index shipping with the Resource Groups Tagging API; explicit membership is fully real now. |
| Resource Groups Tagging API | 9 | JSON 1.1 | Full | Partial | All 9 ops: GetResources (with ResourceARNList / ResourceTypeFilters / TagFilters and pagination), GetTagKeys, GetTagValues, TagResources, UntagResources, GetComplianceSummary, StartReportCreation, DescribeReportCreation, ListRequiredTags. Backed by a cross-service tag index: reads aggregate every service's live tags through a shared provider registry, plus tags applied directly to arbitrary ARNs via TagResources. Account-partitioned and persisted. Per-service tag providers roll out incrementally; today the index reflects tags applied through this API. |
| Resource Access Manager | 35 | REST-JSON | Full | None | Complete 35-op RAM surface: resource shares (create with resource ARNs / principals / permissions at creation, get/update/delete, GetResourceShares with SELF / OTHER-ACCOUNTS resourceOwner filter), resource + principal associations (AssociateResourceShare / DisassociateResourceShare settle straight to ASSOCIATED, GetResourceShareAssociations), cross-account share invitations (Accept/Reject/GetResourceShareInvitations, external principals raise a PENDING invitation), managed + customer permissions with the full version lifecycle (CreatePermission/CreatePermissionVersion/ListPermissionVersions/SetDefaultPermissionVersion/DeletePermissionVersion, AssociateResourceSharePermission/ReplacePermissionAssociations), a seeded AWS-managed default-permission catalogue (AWSRAMDefaultPermission*), ListResourceTypes/ListPrincipals/ListResources, EnableSharingWithAwsOrganization, promote-from-policy, and tagging. Model-derived @length/@range/enum validation. Account-partitioned and persisted. |
| Cost Explorer | 47 | JSON 1.1 | Full | Partial | Complete 47-op Cost Explorer surface. Real, persisted CRUD for the configuration resources: anomaly monitors + subscriptions (CreateAnomalyMonitor/Get/Update/Delete, ProvideAnomalyFeedback), cost category definitions (Create/Describe/Update/Delete/List, ListCostCategoryResourceAssociations), cost-allocation tags (ListCostAllocationTags, UpdateCostAllocationTagsStatus, StartCostAllocationTagBackfill + history), the analysis/recommendation-generation start+list+get ops (settle to a terminal status), and tagging. The cost/usage analytics (GetCostAndUsage(WithResources/Comparisons), GetCostForecast/GetUsageForecast, GetDimensionValues/GetTags/GetCostCategories, reservation + savings-plans coverage/utilization/recommendations, rightsizing) return the model's exact output shape with correctly-bucketed but zeroed/empty result sets — the honest state of an emulator that incurs no billed AWS cost, mirroring how a fake needn't run a billing engine. @length/@range/enum validation enforced. Account-partitioned and persisted. |
| S3 Tables | 49 | REST-JSON | Full | Partial | Complete 49-op S3 Tables surface: the table-bucket -> namespace -> table (Apache Iceberg) hierarchy with real CRUD (CreateTableBucket/CreateNamespace/CreateTable, get/list/delete, RenameTable), the Iceberg metadata-location pointer (GetTableMetadataLocation/UpdateTableMetadataLocation with optimistic versionToken concurrency -> ConflictException on mismatch), and every per-bucket / per-table sub-resource (encryption, policy, maintenance configuration + job status, metrics configuration, replication + status, storage class, record-expiration configuration + job status). Maintenance / expiration / replication jobs settle to a terminal status synchronously. @length/@pattern/enum validation enforced. Account-partitioned and persisted. No Iceberg query engine runs — the metadata location is tracked as an opaque S3 pointer, matching a control-plane mock. |
| Lake Formation | 61 | REST-JSON | Full | Partial | Complete 61-op Lake Formation surface: LF-tags and LF-tag expressions (create/get/update/delete/list, AddLFTagsToResource/RemoveLFTagsFromResource/GetResourceLFTags), fine-grained permission grants (GrantPermissions/RevokePermissions + BatchGrant/BatchRevoke, ListPermissions, GetEffectivePermissionsForPath), registered resources (RegisterResource/DeregisterResource/DescribeResource/UpdateResource), data lake settings (verbatim round-trip), data-cell filters, opt-ins, governance transactions (StartTransaction -> commit/cancel/extend, settle synchronously), Identity Center configuration, table objects + storage optimizers, and LF-tag search. Model-derived @length/@range/enum validation. Account-partitioned and persisted. Temporary-credential vending (GetTemporaryGlue*Credentials, AssumeDecoratedRoleWithSAML) and query planning (StartQueryPlanning/GetWorkUnits) return well-formed synthetic values — there is no backing Glue catalogue or query engine, matching a control-plane mock. |
| CodeConnections | 27 | JSON 1.0 | Full | Control-only | Complete 27-op CodeConnections surface (the successor to CodeStar Connections): connections to third-party source providers (CreateConnection/GetConnection/ListConnections/DeleteConnection, created PENDING per the real console-handshake default, ProviderType enum validated), self-managed hosts for installed provider types (CreateHost/GetHost/UpdateHost/DeleteHost/ListHosts, VpcConfiguration round-trip), repository links (CreateRepositoryLink/Get/Update/Delete/List, provider type inherited from the connection), CloudFormation Git-sync configurations (CreateSyncConfiguration/Get/Update/Delete/List, ListSyncConfigurations/ListRepositorySyncDefinitions), the sync-status / sync-blocker read surface (GetRepositorySyncStatus/GetResourceSyncStatus/GetSyncBlockerSummary/UpdateSyncBlocker), and tagging. Model-derived @length/@range/enum validation with MaxResults/NextToken pagination. Account-partitioned and persisted. No third-party OAuth handshake or Git-sync engine runs, so connections stay PENDING and the sync-status paths report "not found" for never-synced resources — the honest control-plane shape. |
| CodeBuild | 59 | JSON 1.1 | Full | None | Complete 59-op CodeBuild control plane: build projects (CreateProject/UpdateProject/DeleteProject/BatchGetProjects/ListProjects + UpdateProjectVisibility/InvalidateProjectCache), builds and build batches (StartBuild/StopBuild/RetryBuild/BatchGetBuilds/BatchDeleteBuilds/ListBuilds(ForProject) and the full batch variants), report groups + reports (CreateReportGroup/BatchGetReportGroups/GetReportGroupTrend, BatchGetReports/ListReports(ForReportGroup), DescribeTestCases/DescribeCodeCoverages), fleets (CreateFleet/UpdateFleet/BatchGetFleets/ListFleets), webhooks (Create/Update/DeleteWebhook), source credentials (ImportSourceCredentials/DeleteSourceCredentials/ListSourceCredentials), resource policies (Put/Get/DeleteResourcePolicy), curated environment images, and command-execution sandboxes. StartBuild returns immediately with the build IN_PROGRESS and runs the build for real: a background task resolves the environment image, parses the buildspec phases, executes each phase's commands in a Docker/Podman container (honoring CodeBuild phase-failure semantics), streams output to CloudWatch Logs, uploads S3 artifacts, and settles buildStatus on the real container exit codes — with real per-phase phases[] results. An in-flight build is reconciled to FAILED on restart. When no container runtime is available or the backend is disabled (FAKECLOUD_CODEBUILD_DISABLE_BACKEND), the build deterministically settles to SUCCEEDED on read so API shapes are unchanged. Model-derived @length/@range/enum validation; project/report-group/build/fleet ARNs and build ids in exact AWS format. Account-partitioned and persisted. |
| CodeDeploy | 47 | JSON 1.1 | Full | None | Complete 47-op CodeDeploy control plane: applications (CreateApplication/GetApplication/UpdateApplication/DeleteApplication/ListApplications/BatchGetApplications), application revisions (RegisterApplicationRevision/GetApplicationRevision/ListApplicationRevisions/BatchGetApplicationRevisions), deployment groups (CreateDeploymentGroup/GetDeploymentGroup/UpdateDeploymentGroup/DeleteDeploymentGroup/ListDeploymentGroups/BatchGetDeploymentGroups), deployment configurations (CreateDeploymentConfig/GetDeploymentConfig/DeleteDeploymentConfig/ListDeploymentConfigs with the predefined CodeDeployDefault.* configs always resolvable), deployments (CreateDeployment/GetDeployment/BatchGetDeployments/ListDeployments/StopDeployment/ContinueDeployment/SkipWaitTimeForInstanceTermination), deployment targets + instances (GetDeploymentTarget/ListDeploymentTargets/BatchGetDeploymentTargets/GetDeploymentInstance/ListDeploymentInstances/BatchGetDeploymentInstances), on-premises instances (Register/Deregister/Get/List/BatchGetOnPremisesInstances + Add/RemoveTagsFromOnPremisesInstances), GitHub account tokens, lifecycle-hook status, and resource tagging. A CreateDeployment mints a deployment that settles Created->InProgress->Succeeded across successive reads (lazy-settle). Model-derived @length/enum validation with per-op error codes; deployment ids in exact AWS d-XXXXXXXXX format. Account-partitioned and persisted. No deployment engine runs — the actual instance rollout is out of scope, matching how LocalStack Community mocks CodeDeploy. |
| CodePipeline | 44 | JSON 1.1 | Full | None | Complete 44-op CodePipeline control plane: pipelines (CreatePipeline/GetPipeline/UpdatePipeline/DeletePipeline/ListPipelines with version history and PipelineVersionNotFoundException), executions (StartPipelineExecution/GetPipelineExecution/ListPipelineExecutions/StopPipelineExecution/GetPipelineState + ListActionExecutions/ListRuleExecutions/ListDeployActionExecutionTargets), stage operations (EnableStageTransition/DisableStageTransition/RetryStageExecution/RollbackStage/OverrideStageCondition/PutActionRevision/PutApprovalResult), custom action types (CreateCustomActionType/DeleteCustomActionType/ListActionTypes/GetActionType/UpdateActionType), rule types (ListRuleTypes), webhooks (PutWebhook/DeleteWebhook/ListWebhooks/RegisterWebhookWithThirdParty/DeregisterWebhookWithThirdParty), jobs + third-party jobs (Acknowledge/Get/PollFor/PutJobSuccessResult/PutJobFailureResult and third-party variants), and resource tagging. A StartPipelineExecution mints a pipelineExecutionId (UUID) that settles InProgress->Succeeded across successive reads (lazy-settle). Model-derived @length/@range/enum validation with per-op error codes. Account-partitioned and persisted. No release engine runs — the actual source/build/deploy/approval action execution is out of scope, matching how LocalStack Community mocks CodePipeline. |
| CodeArtifact | 48 | REST-JSON | Full | None | Complete 48-op CodeArtifact control plane: domains (CreateDomain/DescribeDomain/DeleteDomain/ListDomains + Put/Get/DeleteDomainPermissionsPolicy), repositories (CreateRepository/DescribeRepository/UpdateRepository/DeleteRepository/ListRepositories/ListRepositoriesInDomain/GetRepositoryEndpoint + Associate/DisassociateExternalConnection and repository permission policies), packages (ListPackages/DescribePackage/DeletePackage/PutPackageOriginConfiguration), package versions (ListPackageVersions/DescribePackageVersion/Delete/Dispose/UpdatePackageVersionsStatus/CopyPackageVersions/PublishPackageVersion/GetPackageVersionReadme/GetPackageVersionAsset/ListPackageVersionAssets/ListPackageVersionDependencies), package groups (CreatePackageGroup/DescribePackageGroup/UpdatePackageGroup/DeletePackageGroup/ListPackageGroups/ListSubPackageGroups/GetAssociatedPackageGroup/ListAssociatedPackages/ListAllowedRepositoriesForGroup/UpdatePackageGroupOriginConfiguration), GetAuthorizationToken, and resource tagging. A PublishPackageVersion stores the asset bytes so a later GetPackageVersionAsset streams them back; GetAuthorizationToken mints a synthetic bearer token with an expiration. Repository endpoints and ARNs are minted in exact AWS format. Model-derived @length/@pattern/enum validation with per-op error codes. Account-partitioned and persisted. No package-manager proxy runs; external-upstream fetching is out of scope, matching how LocalStack Community mocks CodeArtifact. |
| CodeCommit | 79 | JSON 1.1 | Full | None | Complete 79-op CodeCommit git-repository control plane over a real content-addressed object store (blobs/trees/commits keyed by 40-char SHA-1 ids): repositories (Create/Get/Delete/ListRepositories/BatchGetRepositories + UpdateRepositoryDescription/Name/EncryptionKey), branches and files (CreateBranch/DeleteBranch/GetBranch/ListBranches/UpdateDefaultBranch, PutFile/DeleteFile/CreateCommit with the real parentCommitId tip check, GetFile/GetFolder/GetBlob/GetCommit/BatchGetCommits/GetDifferences/ListFileCommitHistory), merges (MergeBranchesByFastForward/BySquash/ByThreeWay, CreateUnreferencedMergeCommit, GetMergeCommit/GetMergeOptions/GetMergeConflicts/DescribeMergeConflicts/BatchDescribeMergeConflicts), pull requests with approvals/events/overrides (CreatePullRequest/GetPullRequest/ListPullRequests/UpdatePullRequest*/DescribePullRequestEvents/MergePullRequestBy*, CreatePullRequestApprovalRule/Delete/UpdatePullRequestApprovalRuleContent, UpdatePullRequestApprovalState/GetPullRequestApprovalStates/EvaluatePullRequestApprovalRules/OverridePullRequestApprovalRules/GetPullRequestOverrideState), approval-rule templates and associations (Create/Get/Delete/ListApprovalRuleTemplates/UpdateApprovalRuleTemplateContent/Description/Name, Associate/Disassociate/BatchAssociate/BatchDisassociate/ListAssociatedApprovalRuleTemplatesForRepository/ListRepositoriesForApprovalRuleTemplate), comments and reactions (PostCommentForComparedCommit/ForPullRequest/Reply, GetComment/GetCommentsFor*/UpdateComment/DeleteCommentContent, PutCommentReaction/GetCommentReactions), repository triggers (Put/Get/TestRepositoryTriggers), and tagging. Clone URLs, ARNs, and repository UUIDs in exact AWS format; three-way merges resolve non-conflicting trees and report ManualMergeRequiredException otherwise. Model-derived @length/@pattern/enum validation with per-op error codes. Account-partitioned and persisted. No live git smart-HTTP transport runs; git push/pull is out of scope, matching how LocalStack Community mocks CodeCommit. |
| Database Migration Service | 119 | JSON 1.1 | Full | None | Complete 119-op DMS control plane: replication instances (settle straight to available), endpoints with per-engine settings that round-trip verbatim, replication tasks (starting->running->stopped, plus assessment runs and table statistics), replication subnet groups, event subscriptions, certificates, connections (TestConnection succeeds against a stored endpoint + instance), serverless replication configs and replications, data providers, instance profiles, migration projects, schema-conversion / metadata-model requests, Fleet Advisor, recommendations, account attributes, and tagging. Real CRUD with Marker/MaxRecords pagination and Filters; @length/@range/enum constraints enforced. Account-partitioned and persisted. No data-migration engine — the actual row movement is out of scope, matching how LocalStack Community mocks DMS. |
| Transfer Family | 71 | JSON 1.1 | Full | None | Complete 71-op Transfer Family control plane: SFTP/FTPS/FTP/AS2 servers (StartServer/StopServer settle State straight to ONLINE/OFFLINE), users and their SSH public keys, host keys, service-managed accesses, workflows and executions (SendWorkflowStepState), AS2 agreements, connectors (SFTP + AS2, with TestConnection, StartFileTransfer, StartDirectoryListing, StartRemoteDelete/StartRemoteMove, and ListFileTransferResults), profiles, certificates, the managed security-policy catalogue, web apps (+ customization), TestIdentityProvider, and tagging. Real CRUD with MaxResults/NextToken pagination; @length/@range/enum constraints enforced. Nested config round-trips verbatim. Account-partitioned and persisted. No SFTP daemon or AS2 transport engine — the file movement itself is out of scope, matching how LocalStack Community mocks Transfer. |
| Aurora DSQL | 16 | REST-JSON | Full | Control-only | Full 16-op control plane: cluster lifecycle with async CREATING->ACTIVE and DELETING->DELETED transitions, clientToken idempotency, deletion-protection enforcement, multiRegionProperties round-trip, 26-char lowercase cluster ids with arn:aws:dsql:<region>:<acct>:cluster/<id> ARNs and <id>.dsql.<region>.on.aws endpoint hosts, cluster resource policies, change streams to Kinesis, GetVpcEndpointServiceName, and tagging. State is account-partitioned and persists across restarts in persistent mode. The PostgreSQL-compatible data plane (a reachable container + IAM-token auth) is a pending follow-up. |
| ElastiCache | 75 | JSON 1.1 (Query) | Full | Full | Real Redis, Valkey, and Memcached via Docker. RestoreFromSnapshot uses real RDB dump format. ACL SETUSER and CONFIG SET commands are supported. |
| Elastic Beanstalk | 47 | Query (XML) | Full | Control plane | Full 47-op control plane as an orchestration facade: applications, application versions (source bundle in S3), configuration templates, configuration option settings across namespaces (aws:autoscaling:launchconfiguration, aws:elasticbeanstalk:environment, ...), events, platform/solution-stack listing, DNS/CNAME availability, SwapEnvironmentCNAMEs, tags, and account attributes. Environments carry a real modeled lifecycle: CreateEnvironment returns Launching immediately then a background task settles it to Ready (emitting the matching Events), UpdateEnvironment -> Updating -> Ready, TerminateEnvironment -> Terminating -> Terminated, with Green/Yellow/Red/Grey health derived from that state (never faked). CNAMEs (<prefix>.<hash>.<region>.elasticbeanstalk.com), ELB-style endpoints, and e-xxxxxxxxxx ids match AWS. Account-partitioned and persisted; in-flight transitions reconcile on restart. The application data plane (spawning a container that serves the deployed version) is a pending follow-up. |
| MemoryDB | 45 | JSON 1.1 | Full | Control plane | Full control plane for clusters, shards, ACLs, users, parameter/subnet groups, snapshots, and multi-region clusters, with persistence. Clusters transition creating -> available on describe. Redis/Valkey data-plane container backing is a roadmap item. |
| Amazon Managed Service for Apache Flink | 33 | JSON 1.1 | Full | Control plane | Full 33-op control plane for kinesisanalyticsv2 (formerly Kinesis Data Analytics v2), signing as kinesisanalytics: SQL and Flink streaming applications with their full configuration (inputs/outputs/reference data sources, Flink code/environment/checkpoint/monitoring/parallelism, VPC + CloudWatch logging options) persisted and echoed on describe. StartApplication settles READY -> STARTING -> RUNNING, StopApplication -> STOPPING -> READY (with Force), RollbackApplication restores the previous version. Every config-changing op bumps ApplicationVersionId with full version history and CurrentApplicationVersionId/ConditionalToken optimistic concurrency; snapshots (CREATING -> READY), async operation records, DiscoverInputSchema, presigned dashboard URLs, maintenance windows, and ARN-keyed tagging. Account-partitioned and persisted. The real Flink-job data plane (a running Docker container) is a roadmap item. |
| EKS | 65 | REST-JSON | Partial | Control plane | Complete 65-op EKS control plane: clusters (incl. connected-cluster register/deregister), managed node groups, Fargate profiles, add-ons, access entries + access policies, OIDC identity-provider configs, pod-identity associations, upgrade insights, capabilities, encryption config, and EKS Anywhere subscriptions (create/describe/list/delete, config + version updates with tracking, cluster-version/add-on/access-policy catalogues, tagging), persisted; resources transition CREATING -> ACTIVE on describe. No real Kubernetes control-plane endpoint (models the AWS management API, not kubectl traffic). |
| Amazon EFS | 31 | REST-JSON | Full | Control plane | Complete 31-op Amazon Elastic File System control plane: file systems (async creating -> available on describe, CreationToken idempotency, size breakdown, performance/throughput modes, encryption, and replication-overwrite protection), mount targets (one per Availability Zone per file system, with the AZ / VPC / network interface / IP resolved from the real referenced subnet in EC2 state), access points (POSIX user + root directory), lifecycle configuration, backup policy, file-system resource policy, replication configurations, resource tagging (both the resource-id API and the deprecated per-file-system Create/Delete/Describe tags API), and account preferences. fs-/fsmt-/fsap- ids, arn:aws:elasticfilesystem:... ARNs, and OwnerId match AWS. Account-partitioned and persisted; in-flight lifecycle transitions reconcile on restart. No real NFS data plane is served (models the AWS management API). |
| Amazon MQ | 25 | REST-JSON | Full | Data plane | Complete 25-op Amazon MQ control plane PLUS a real, connectable broker data plane: CreateBroker background-spawns a real engine container (apache/activemq-classic for ActiveMQ, rabbitmq:3.13-alpine for RabbitMQ) and settles CREATION_IN_PROGRESS -> RUNNING only once the broker actually accepts connections; brokerInstances returns the REAL reachable host + mapped ports so a client genuinely connects (OpenWire/AMQP/STOMP/MQTT/WS + console for ActiveMQ, AMQP for RabbitMQ). Broker users are injected into the live broker (ActiveMQ simpleAuthenticationPlugin+authorizationPlugin via a generated activemq.xml; RabbitMQ rabbitmqctl), and a user-supplied ActiveMQ configuration revision is docker cp-ed into the container so it genuinely configures the broker; RebootBroker restarts the container applying staged pending user/config changes, DeleteBroker tears it down, and RUNNING brokers reconcile on restart by re-attaching their persisted container (preserving message data) or respawning if it is gone. CloudFormation AWS::AmazonMQ::Broker spawns a real backing container the same way (settling CREATION_IN_PROGRESS -> RUNNING; stack delete reaps it). creatorRequestId idempotency; configurations (c- ids, base64 Data revisions, revision history), per-broker users (CREATE/UPDATE/DELETE staging - ActiveMQ on reboot, RabbitMQ immediately), ARN-keyed tagging, and the DescribeBrokerEngineTypes / DescribeBrokerInstanceOptions catalogues. b-/c- ids and arn:aws:mq:... ARNs match AWS. Account-partitioned and persisted. Degrades to control-plane-only when no container runtime is available. |
| Amazon MSK | 64 | REST-JSON | Full | Data plane | Complete 64-op Amazon MSK (Managed Streaming for Apache Kafka) control plane PLUS a real, connectable Kafka broker data plane, signing as kafka: each provisioned cluster is backed by a REAL single-node Apache Kafka broker container (apache/kafka:3.8.0, KRaft combined mode). CreateCluster background-spawns the broker and settles CREATING -> ACTIVE only once it actually serves; GetBootstrapBrokers returns the REAL reachable host:port a genuine Kafka client produces and consumes through (proven by an end-to-end produce/consume round trip in CI); the topic operations (CreateTopic/DescribeTopic/ListTopics/UpdateTopic/DeleteTopic/DescribeTopicPartitions) are driven against the live broker with its own kafka-topics.sh / kafka-configs.sh tools; RebootBroker restarts the container in place preserving the topic log, DeleteCluster tears it down, and an ACTIVE cluster reconciles on restart by re-attaching its persisted container (or respawning if it is gone). Single-container simplification: replication factor is clamped to 1 and ListNodes surfaces broker 1 as the live node. Also: provisioned + serverless clusters (CreateCluster/CreateClusterV2, monotonic arn:aws:kafka:...:cluster/<name>/<uuid>-<n> ARNs, ClusterNameFilter/ClusterTypeFilter + pagination, region-scoped, duplicate-name ConflictException, the DescribeClusterV2 provisioned/serverless union); the eleven Update*/RebootBroker operations that each record a ClusterOperation (settling PENDING -> UPDATE_COMPLETE), apply the change, bump CurrentVersion, and settle the cluster back to ACTIVE; configurations with base64 ServerProperties and monotonic revisions; channels (CreateChannel/DescribeChannel/ListChannels/UpdateChannel/DeleteChannel, settling CREATING -> ACTIVE, S3/Iceberg destinations, per-cluster + TopicNameFilter); SCRAM secret association; cluster resource policies; client VPC connections and replicators (full CRUD, settling to AVAILABLE/RUNNING); the supported/compatible Kafka version catalogs; and ARN-keyed tagging. Account-partitioned and persisted; in-flight lifecycle transitions reconcile on restart. Degrades to control-plane-only (cosmetic *.amazonaws.com bootstrap strings, in-memory topics) when no container runtime is available, or for serverless clusters. CloudFormation provisions every AWS::MSK::* type (Cluster, ServerlessCluster, Configuration, ClusterPolicy, BatchScramSecret, VpcConnection, Replicator) through the same shared record builders the direct API uses (write-through persistence + Ref/Fn::GetAtt; a provisioned cluster is backed by the same real Kafka container, stack delete reaps it). Exercised by the upstream terraform-provider-aws MSK acceptance tests. |
| AWS FIS | 26 | REST-JSON | Full | Control plane | Complete 26-op AWS Fault Injection Simulator control plane: experiment templates (Create/Get/Update/Delete/ListExperimentTemplate) echoing targets/actions/stopConditions verbatim with EXT-shaped ids and arn:aws:fis:<region>:<account>:experiment-template/<id> ARNs; the experiment lifecycle (StartExperiment begins initiating and settles initiating -> running -> completed deterministically on the next read; StopExperiment moves to stopping -> stopped; each action's state tracks the run) with EXP-shaped ids; the AWS-provided static actions catalog (ListActions/GetAction return real ids like aws:ec2:stop-instances, aws:ecs:stop-task, aws:ssm:send-command, aws:fis:inject-api-internal-error, ... with their parameters + target roles) and target-resource-type catalog (ListTargetResourceTypes/GetTargetResourceType); per-template and per-experiment multi-account target-account configurations (Create/Update/Delete/Get/ListTargetAccountConfiguration, reflected by the template's targetAccountConfigurationsCount); resolved-target listing (ListExperimentResolvedTargets); account-level safety levers (GetSafetyLever/UpdateSafetyLeverState); and ARN-keyed TagResource/UntagResource/ListTagsForResource. Model-derived required/@length/@range/enum validation, account-partitioned and persisted; in-flight experiment transitions reconcile on restart. The real fault injection into other services (stopping EC2 instances, draining ECS tasks, ...) is a later batch — the control plane is modelled faithfully and experiments progress through their states without perturbing real resources. |
| Amazon EMR | 65 | JSON 1.1 | Full | Control plane | Full 65-op EMR (Elastic MapReduce) control plane: clusters via RunJobFlow (j- ids, arn:aws:elasticmapreduce:...:cluster/<id> ARNs, instance groups/fleets + EC2 instances derived from the request, settling to WAITING), steps (s- ids, StepStates/StepIds filters, CancelSteps), instance groups (ig-) + auto-scaling policies, instance fleets (if-), instances + bootstrap actions, managed-scaling / auto-termination policies, security configurations (duplicate-name rejection), EMR Studio (es-) + session mappings, notebook executions, persistent app UIs, interactive sessions, block-public-access, release labels + supported instance types, and cluster/Studio tagging. Model-driven input validation (required/length/range/enum); a request against a non-existent cluster returns InvalidRequestException. Account-partitioned and persisted. Real Spark/Hadoop job execution in containers is a roadmap item. |
| Amazon MWAA | 12 | REST-JSON | Full | Control plane | Complete 12-op Amazon MWAA (Managed Workflows for Apache Airflow) control plane, signing as airflow: environments (CreateEnvironment/GetEnvironment/UpdateEnvironment/DeleteEnvironment/ListEnvironments) with the async lifecycle modelled by the control-plane state machine — created CREATING, settling to AVAILABLE on the next read; UpdateEnvironment applies the change, moves to UPDATING, and records a LastUpdate that settles SUCCESS; DeleteEnvironment moves to DELETING and is removed on the next read; arn:aws:airflow:<region>:<account>:environment/<name> ARNs, EnvironmentName pattern + account/region name-uniqueness validation, AWS-synthesized WebserverUrl / ServiceRoleArn / CeleryExecutorQueue / per-module LoggingConfiguration with CloudWatchLogGroupArns. The short-lived CreateCliToken / CreateWebLoginToken access tokens (+ WebServerHostname), InvokeRestApi (returns the modelled RestApiServerException until the Airflow web-server data plane is attached), the internal PublishMetrics sink, and ARN-keyed TagResource / UntagResource / ListTagsForResource. Account-partitioned and persisted; in-flight lifecycle transitions reconcile on restart. The real Docker-backed Apache Airflow web server / DAG runtime is a later batch. |
| AWS Elemental MediaConvert | 34 | REST-JSON | Full | Control plane | Complete 34-op AWS Elemental MediaConvert control plane: queues (CreateQueue/GetQueue/ListQueues/UpdateQueue/DeleteQueue) with ON_DEMAND/RESERVED pricing plans (a reservation plan is materialised for reserved queues), ACTIVE/PAUSED status, and the seeded undeletable Default SYSTEM queue per account; presets and job templates (Create/Get/List/Update/Delete) storing their settings verbatim so reads echo exactly what writes persisted; jobs (CreateJob mints an arn:aws:mediaconvert:<region>:<account>:jobs/<id> job, persists settings/role/queue/priority, and settles SUBMITTED -> COMPLETE on the next GetJob/ListJobs read with well-formed outputGroupDetails/timing; CancelJob -> CANCELED; SearchJobs filters by queue/status/input file); the account input-restriction policy (PutPolicy/GetPolicy/DeletePolicy, defaulting each input class to ALLOWED); DescribeEndpoints (echoes a deterministic account-specific endpoint URL that points back at the fakecloud host); certificate association (Associate/DisassociateCertificate); resource sharing (CreateResourceShare); jobs queries (StartJobsQuery/GetJobsQueryResults); engine versions (ListVersions); and ARN-keyed TagResource/UntagResource/ListTagsForResource. Model-derived required/enum/range validation with each op's declared BadRequestException/NotFoundException/ConflictException; account-partitioned and persisted. Known limitation: fakecloud does not run a real video transcoder -- no media is read or written, so a job settles COMPLETE with correctly-shaped but empty outputGroupDetails and Probe returns an empty probeResults list rather than fabricating container metadata. This is the faithful control plane a real transcode would build on. |
| Amazon Managed Blockchain | 27 | REST-JSON | Full | Control plane | Complete 27-op Amazon Managed Blockchain control plane: networks (CreateNetwork mints an n-... id + global arn:aws:managedblockchain:::networks/<id> ARN, stores framework HYPERLEDGER_FABRIC/ETHEREUM + framework version + voting policy, and for Fabric atomically creates the requested first member (m-...), returning both NetworkId and MemberId; GetNetwork/ListNetworks filtered by name/framework/status, paginated); members (full CRUD of m-..., Fabric CaEndpoint/AdminUsername attributes, log-publishing config, CREATING -> AVAILABLE on read, DeleteMember -> DELETED); nodes (full CRUD of nd-..., InstanceType/AvailabilityZone/StateDB and deterministically derived Fabric peer / Ethereum HTTP+WebSocket endpoints); proposals + voting (CreateProposal mints p-... with IN_PROGRESS + an expiration from the network's ProposalDurationInHours; VoteOnProposal records a YES/NO vote per member and, when the ApprovalThresholdPolicy threshold is met, transitions the proposal to APPROVED — materialising each invitation into a real Invitation in the invited principal's account and applying removals — or REJECTED; ListProposalVotes/GetProposal/ListProposals); invitations (ListInvitations, RejectInvitation -> REJECTED); accessors (CreateAccessor mints a UUID id + BillingToken + ARN, AccessorType BILLING_TOKEN, AVAILABLE; Get/List/DeleteAccessor); and ARN-keyed TagResource/UntagResource/ListTagsForResource. Model-derived required/enum validation with each op's declared InvalidRequestException/ResourceNotFoundException/IllegalActionException; account-partitioned and persisted. Honest gap: no real Hyperledger Fabric or Ethereum network runs — the ordering-service/CA/peer/JSON-RPC endpoints are well-formed deterministic URLs pointing at no live chain. |
| Amazon S3 Glacier | 33 | REST-JSON | Full | Full | Complete 33-op Glacier surface: vaults (create/describe/delete/list), archive upload/delete storing the real bytes with a computed SHA-256 tree hash, multipart uploads that assemble their parts into a stored archive, retrieval and inventory jobs that settle to Succeeded on read so GetJobOutput returns the exact uploaded bytes (or a JSON inventory), vault notifications, vault access policy, the vault-lock state machine (InProgress -> Locked with a 24h lock-id expiry), per-vault tags, the account data-retrieval policy, and provisioned capacity; account-scoped paths accept the literal -, and archive/upload/job ids plus x-amz-sha256-tree-hash / Location are mirrored in response headers. Persisted; archives survive restart. |
| AWS Backup | 109 | REST-JSON | Full | Control plane | Complete 109-op AWS Backup control plane: backup plans (with versions) + selections, backup vaults (standard, logically-air-gapped, restore-access) with notifications / access policies / lock configuration, recovery points, backup / copy / restore / scan jobs (progressed synthetically to a terminal state so Describe/List show completed work; StartBackupJob records a synthetic recovery point that DescribeRecoveryPoint resolves), frameworks, report plans + jobs, legal holds, restore-testing plans + selections, tiering configurations, protected resources, tags, and account-scoped global / region settings; persisted. No real backup engine runs (models the AWS management API, moves no bytes), matching LocalStack Community's control-plane treatment. |
| AWS AppConfig | 58 | REST-JSON | Full | Full | Complete 58-op AppConfig surface across one crate serving both appconfig (56 ops) and appconfigdata (2 ops): applications, environments, configuration profiles, hosted configuration versions (raw bytes + content type stored and returned verbatim, with an auto-incrementing version number), custom and AWS-predefined deployment strategies, deployments (settled to COMPLETE synchronously with an event log), extensions and extension associations, experiment definitions and runs, account settings, ValidateConfiguration, and tagging. The AppConfig Data plane (StartConfigurationSession -> GetLatestConfiguration) resolves a session token to the latest deployed hosted-config bytes and returns them with a next-poll token. @length/@range/enum constraints enforced. Account-partitioned and persisted. |
| OpenSearch Service | 96 | REST-JSON | Full | Control plane | Complete 96-op Amazon OpenSearch Service control plane sharing one domain store with Elasticsearch Service (both sign as es): domains (create/describe/delete/config-update persist; a new domain settles Processing=false/Created=true with a synthetic search endpoint on describe), packages, VPC endpoints, cross-cluster inbound/outbound connections, applications + capabilities, application migrations (StartMigration/GetMigration/ListMigrations), per-domain data sources + indices, direct-query data sources, reserved instances, tags, plus instance-type/version/upgrade/dry-run/health catalogues; persisted. No real OpenSearch cluster is spawned (models the AWS management API, not the search data plane). |
| Elasticsearch Service | 51 | REST-JSON | Full | Control plane | Complete 51-op legacy Amazon Elasticsearch Service (es, API version 2015-01-01) exposed over the SAME shared domain store as OpenSearch Service: a domain created through either API is one entity, surfaced here via the ElasticsearchDomainStatus shape. Domains, packages, VPC endpoints, cross-cluster search connections, reserved instances, tags, and instance-type/version/upgrade catalogues, persisted. No real Elasticsearch cluster is spawned. |
| Cloud Map | 30 | JSON 1.1 | Partial | Control plane + discovery | Complete 30-op AWS Cloud Map (servicediscovery): HTTP/public-DNS/private-DNS namespaces, services (DnsConfig/HealthCheck + attributes), instance register/deregister/get/list + health status, DiscoverInstances/DiscoverInstancesRevision data-plane lookup, and tagging — driven by the async operation model (mutations return an OperationId that settles SUCCESS on GetOperation); persisted. No DNS/HTTP data plane beyond the discovery API. |
| Account Management | 16 | REST-JSON | Full | Full | Complete 16-op AWS Account control plane: alternate contacts (BILLING/OPERATIONS/SECURITY get/put/delete), primary contact information, account information + name, GovCloud account pairing, primary-email management (start/accept OTP flow with GetPrimaryEmailUpdateStatus lifecycle tracking), and Region opt-in control (ListRegions, GetRegionOptStatus, Enable/DisableRegion with ENABLING->ENABLED settle-on-read over the real opt-in-region catalogue). Honors the optional AccountId member so an organization's management account can act on a member; account-partitioned and persisted. |
| IAM Identity Center Identity Store | 19 | JSON 1.1 | Full | Full | Complete 19-op Identity Store directory: users, groups, and group memberships (create/describe/update/delete/list), the attribute-lookup helpers GetUserId/GetGroupId/GetGroupMembershipId (by UniqueAttribute), and IsMemberInGroups. Nested SCIM attribute bags (Name, Emails, Addresses, PhoneNumbers, ...) round-trip verbatim; @length/@range constraints enforced. Account-partitioned and persisted. |
| IAM Identity Center SSO Admin | 79 | JSON 1.1 | Full | Full | Complete 79-op SSO Admin control plane: IAM Identity Center instances and regions, permission sets with inline/managed/customer-managed/boundary policies, account assignments and permission-set provisioning (async status settle), applications with assignments/access-scopes/authentication-methods/grants/session config, the application-provider catalogue, trusted token issuers, access-control attribute configuration, and tagging. Nested config objects round-trip verbatim; @length/@range constraints enforced. Account-partitioned and persisted. |
| Verified Permissions | 34 | JSON 1.0 | Full | Full | Complete 34-op Cedar authorization control plane: policy stores, Cedar schemas (PutSchema/GetSchema), static and template-linked policies, policy templates, identity sources (Cognito/OIDC), policy-store aliases, and tagging. IsAuthorized/IsAuthorizedWithToken/BatchIsAuthorized/BatchIsAuthorizedWithToken compute real Cedar decisions via the official cedar-policy engine — the store's policies are compiled into a Cedar PolicySet, the request principal/action/resource/context/entities are translated to Cedar values, and the ALLOW/DENY decision, determining policies and evaluation errors are returned. *WithToken resolves the principal from the JWT sub claim per the identity source. @length/@range/enum constraints enforced. Account-partitioned and persisted. |
| Step Functions | 37 | JSON 1.1 | Full | Full | Full ASL interpreter with .sync wait patterns, waitForTaskToken, and generic aws-sdk:* integrations. |
| Amazon SWF | 39 | JSON 1.0 | Full | Full (state machine) | Full 39-op Simple Workflow Service surface: domains (Register/Deprecate/Undeprecate/Describe/ListDomains, REGISTERED/DEPRECATED status, /domain/ ARNs), versioned activity + workflow types (Register/Deprecate/Undeprecate/Delete/Describe/List, default* configuration echoed back, Delete requires prior deprecation), and workflow executions driven by a real decider/worker state machine — StartWorkflowExecution mints a runId and seeds WorkflowExecutionStarted + DecisionTaskScheduled; PollForDecisionTask returns the next decision task with the full history (appending DecisionTaskStarted); RespondDecisionTaskCompleted applies decisions (ScheduleActivityTask, CompleteWorkflowExecution, Fail/Cancel/ContinueAsNew, RecordMarker, StartTimer/CancelTimer, RequestCancelActivityTask, signal/child/lambda) into the right history events; PollForActivityTask hands out the scheduled activity; RespondActivityTask{Completed,Failed,Canceled} records the outcome and schedules the next decision task; RecordActivityTaskHeartbeat. Plus Describe/GetHistory/List+CountOpen/ClosedWorkflowExecutions, CountPending{Activity,Decision}Tasks, Signal/RequestCancel/TerminateWorkflowExecution, and ARN-keyed domain tagging. Model-driven required/length/range/enum validation with SWF's declared faults (UnknownResourceFault/DomainAlreadyExistsFault/TypeAlreadyExistsFault/TypeDeprecatedFault/TypeNotDeprecatedFault/DefaultUndefinedFault/WorkflowExecutionAlreadyStartedFault). Account-partitioned and persisted. Honest gap: no autonomous clock fires timer/task/execution timeouts — those transitions are decider/worker-driven. |
| AWS Support | 16 | JSON 1.1 | Full | None (TA/agent gap) | Full 16-op Support surface: the support-case API (CreateCase mints an AWS-shaped case-{account}-{year}-{hex} id + numeric displayId, opens opened, and seeds the communication thread; DescribeCases filters by case-id list / displayId / time window / includeResolvedCases / includeCommunications / language with a round-tripping nextToken; AddCommunicationToCase appends and returns result: true; DescribeCommunications pages the thread; ResolveCase returns initialCaseStatus + finalCaseStatus (resolved)); attachment sets (AddAttachmentsToSet mints/extends an attachmentSetId with an expiryTime; DescribeAttachment returns a stored attachment); the severity levels (DescribeSeverityLevels) and service/category catalogues (DescribeServices / DescribeCreateCaseOptions / DescribeSupportedLanguages); and the Trusted Advisor API (DescribeTrustedAdvisorChecks returns the vendored check catalogue, DescribeTrustedAdvisorCheckResult / DescribeTrustedAdvisorCheckSummaries return well-formed all-clear results, and RefreshTrustedAdvisorCheck + DescribeTrustedAdvisorCheckRefreshStatuses drive a real per-check none -> enqueued -> processing -> success refresh state machine). Model-driven required/length/range validation with Support's declared exceptions (CaseIdNotFound / AttachmentIdNotFound / AttachmentSetIdNotFound). Account-partitioned and persisted. Honest gap: no Trusted Advisor analysis engine runs and no live support agent replies, so check results report zero flagged resources and cases receive no automated agent response. |
| AWS Serverless Application Repository | 14 | REST-JSON | Full | Control plane | Complete 14-op AWS Serverless Application Repository control plane: applications (CreateApplication mints the arn:aws:serverlessrepo:<region>:<account>:applications/<name> ARN that doubles as the applicationId, stores author/description/name/homePageUrl/labels/license/readme/spdxLicenseId/sourceCodeUrl and — when a semanticVersion + template is supplied — seeds an initial version; GetApplication returns the app plus its Version block with parameterDefinitions parsed from the SAM/CloudFormation template, requiredCapabilities, and resourcesSupported, optionally pinned to a semanticVersion; ListApplications paginates with a round-tripping nextToken; UpdateApplication patches the mutable metadata; DeleteApplication); versions (CreateApplicationVersion — a PUT carrying the semantic version in the path — stores the template and parses parameterDefinitions/requiredCapabilities/resourcesSupported, plus sourceCodeUrl/sourceCodeArchiveUrl; ListApplicationVersions); sharing policy (PutApplicationPolicy/GetApplicationPolicy over principals/actions/principalOrgIDs statements each assigned a statementId; UnshareApplication removes an organisation share); CloudFormation templates (CreateCloudFormationTemplate mints a templateId + expiry and a templateUrl pointing back at the fakecloud host, status PREPARING settling to ACTIVE on the first GetCloudFormationTemplate); and ListApplicationDependencies (nested-application dependencies parsed from a template's AWS::Serverless::Application resources, paginated). Model-derived required/label validation with each op's declared BadRequestException/NotFoundException/ConflictException; account-partitioned and persisted. Honest gaps: CreateCloudFormationChangeSet mints well-formed changeSetId/stackId identifiers but does not drive the CloudFormation service to materialise a real stack (no clean in-process seam), and the returned templateUrl is a well-formed host-relative URL that fakecloud does not yet serve raw template bytes at. |
| API Gateway v1 | 124 | REST-JSON | Full | Full | Authorizer enforcement (TOKEN/REQUEST/COGNITO_USER_POOLS), request validators, VTL templates (MOCK and HTTP integrations), AWS direct service integrations, VPC_LINK integrations, and custom domain name + base path mapping routing are all implemented in the HTTP data plane. |
| API Gateway v2 | 103 | JSON 1.1 | Full | Full | WebSocket support ($connect/$disconnect/$default), JWT and Lambda authorizer enforcement, AWS service integrations, access log delivery to CloudWatch Logs, stage variables, and custom domain routing are all implemented in the HTTP data plane. |
| Bedrock | 103 | JSON 1.1 | Full | Partial | Control plane (guardrails, custom models, jobs, inference profiles, account data retention) is fully implemented. Runtime (InvokeModel, Converse, streaming) performs real model inference when an upstream LLM endpoint is configured via FAKECLOUD_BEDROCK_UPSTREAM_*, translating both request and response between the Bedrock provider-native shapes and the upstream protocol; unconfigured, it returns deterministic offline responses with real token counting and fault injection. |
| Bedrock Runtime | 10 | JSON 1.1 | Full | Partial | Same as Bedrock runtime notes above. |
| Bedrock Agent | 72 | JSON 1.1 | Full | Partial | Full Agents control plane: agents, agent versions/aliases, action groups, knowledge bases, data sources, ingestion jobs, prompt management, flows, and flow aliases/versions. Knowledge-base ingestion and retrieval are shape-correct synthetic — the embedding/foundation model itself is out of scope, see the "never implement" list below. |
| Bedrock Agent Runtime | 31 | JSON 1.1 | Full | Partial | InvokeAgent, Retrieve, RetrieveAndGenerate, InvokeFlow, and the streaming variants are wired end-to-end with shape-correct synthetic chunks. No real foundation-model inference — see Bedrock runtime caveat above. |
| ECR | 58 | JSON 1.1 | Full | Full | OCI v2 push/pull is real. Lifecycle policy evaluation, image scanning, pull-through cache, registry templates, and cosign signature verification are all implemented. |
| ECS | 77 | JSON 1.1 (Query) | Full | Full | Real Fargate-style task execution via Docker, services with rolling deployments + blue/green lifecycle-hook pauses (ContinueServiceDeployment), task sets, container instances, capacity providers, and ECS Exec. Multi-container tasks, volume mounts, health checks, and dependsOn ordering are all implemented. |
| ELBv2 | 51 | JSON 1.1 (Query) | Full | Partial | Control plane (ALB/NLB/GWLB CRUD, target groups, listeners, rules, mTLS trust stores) is fully implemented. An in-process HTTP data plane for ALBs handles rule matching, forwarding, fixed-response, redirect, and sticky sessions. WAFv2 inspection is wired into the ALB data plane. NLB and GWLB data planes are not implemented. |
| CloudFront | 147 | REST-XML | Full | Partial | Control plane is fully implemented (distributions, policies, functions, key value stores, etc.). An in-process HTTP data plane serves enabled distributions from their origins: a per-distribution listener (discovered via /_fakecloud/cloudfront/distributions), path-pattern cache-behavior routing, S3-website and custom origins, and CustomErrorResponses (the SPA 404 -> /index.html fallback). Not implemented: a global/geo edge network, in-path CloudFront Functions / Lambda@Edge (CloudFront Functions can still be exercised out-of-band via TestFunction; Lambda@Edge cannot), TTL caching / invalidation, and OAC/SigV4 to private S3 origins. |
| CloudTrail | 60 | JSON 1.1 | Full | None | Complete 60-op CloudTrail control plane: trails (create/get/update/delete, DescribeTrails, ListTrails), per-trail logging that GetTrailStatus reflects (StartLogging/StopLogging toggle IsLogging, which starts false), event selectors and insight selectors that persist and round-trip, CloudTrail Lake event data stores (full CRUD + RestoreEventDataStore PENDING_DELETION -> ENABLED + ingestion start/stop + federation enable/disable), channels, imports, Lake queries (StartQuery/DescribeQuery/GetQueryResults settle to FINISHED with empty rows, CancelQuery), dashboards, resource policies, organization delegated admins, event configuration, and tagging. LookupEvents, ListPublicKeys, and ListInsightsMetricData return real empty result sets. @length/@range/enum constraints enforced. Account-partitioned and persisted. No event-recording engine — a fake needn't record its own API activity, matching how LocalStack Community mocks CloudTrail. |
| Route 53 | 71 | REST-XML | Full | Partial | Control plane is fully implemented (hosted zones, RRsets, health checks, DNSSEC, traffic policies, etc.). TestDNSAnswer resolves routing policies and alias targets using fakecloud state. A real DNS server on UDP/TCP 53 is not implemented by default. |
| Route 53 Resolver | 72 | JSON 1.1 | Full | Control-only | Complete 72-op control plane: resolver endpoints (validated against real EC2 VPC subnets + security groups, CREATING->OPERATIONAL settle), resolver rules + VPC associations, query-log configurations + associations, DNS Firewall rule groups / domain lists / rules (ALLOW/BLOCK/ALERT) / rule-group associations, per-VPC firewall / resolver / DNSSEC configuration, Outpost resolvers, resource-based policies, and tags. State machines, deletion guards, and @length/@range/enum constraints are enforced; account-partitioned and persisted; CloudFormation-provisioned. DNS query forwarding/filtering at endpoints (the Resolver data plane) is not implemented. |
| WAFv2 | 55 | JSON 1.1 | Full | Control-only | Control plane is fully implemented (WebACLs, rule groups, IP sets, regex patterns, API keys, managed rules, logging). WAFv2 inspection is wired into the ELBv2 ALB data plane and API Gateway v1+v2 data planes, but CloudFront and AppSync associations are stored only. Rate-based rules and CAPTCHA/Challenge actions are not enforced against real traffic. |
| Application Auto Scaling | 14 | JSON 1.1 | Full | Partial | Control plane is fully implemented (scalable targets, step/target-tracking/predictive policies, scheduled actions). Scaling actions fire and update the target service (UpdateService for ECS, UpdateTable for DynamoDB, etc.), but the actual metric-driven alarm loop is synthesized. |
| Athena | 70 | JSON 1.1 | Full | Control-only | Control plane is fully implemented. StartQueryExecution synthesizes a SUCCEEDED execution with a single-row ["1"] result. fakecloud is not a SQL engine. |
| ACM | 17 | JSON 1.1 | Full | Partial | Control plane is fully implemented. Certificates are self-signed (rcgen) or imported PEM. DNS validation is auto-promoted after a configurable delay; there is no real CA or DNS validation pipeline. EMAIL validation stays PENDING_VALIDATION until approved via the admin endpoint. |
| ACM PCA | 23 | JSON 1.1 | Full | Full | Real private CA hierarchy. CreateCertificateAuthority mints a genuine CA key pair and (for a ROOT CA) a self-signed certificate; a SUBORDINATE CA starts PENDING_CERTIFICATE and serves a real PEM CSR from GetCertificateAuthorityCsr until its signed chain is installed via ImportCertificateAuthorityCertificate. IssueCertificate signs real end-entity certificates from the caller's CSR that verify against the CA (rcgen). Revocation, audit reports, resource permissions, and resource policies are implemented. CA private keys are persisted so issued certs still verify after a restart. |
| Config | 97 | JSON 1.1 | Full | Partial | Real configuration recorder: a running recorder snapshots the live state of other fakecloud services (S3, EC2, IAM) into genuine ConfigurationItem history that GetResourceConfigHistory / BatchGetResourceConfig / ListDiscoveredResources return. PutResourceConfig records external resources. AWS managed rules (S3_BUCKET_VERSIONING_ENABLED, S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED, S3_BUCKET_PUBLIC_READ/WRITE_PROHIBITED, IAM_USER_NO_POLICIES_CHECK, EC2_INSTANCE_NO_PUBLIC_IP, VPC_DEFAULT_SECURITY_GROUP_CLOSED, INCOMING_SSH_DISABLED, RESTRICTED_INCOMING_TRAFFIC, REQUIRED_TAGS) run real evaluation against the recorded items; custom CUSTOM_LAMBDA rules invoke the referenced Lambda via fakecloud-lambda. SelectResourceConfig runs a real SQL-subset query over the recorded items. Compliance queries, conformance packs, aggregators, remediation, retention, and stored queries are implemented. Unimplemented managed rules evaluate as INSUFFICIENT_DATA rather than a fabricated result. |
| CloudWatch (Metrics & Alarms) | 49 | JSON 1.1 (Query) | Full | Partial | Metrics, statistics, dashboards, metric/composite alarms, anomaly detectors, insight rules, metric streams, alarm mute rules, contributor insights, OTel enrichment, dataset KMS key management, and tagging are all implemented with persisted in-memory state. Alarm threshold transitions trigger SNS/AppAS/EC2 actions. GetMetricWidgetImage returns a deterministic image blob. Metrics do not persist across server restarts. |
| Firehose | 12 | JSON 1.1 | Full | Full | Real S3 destination delivery with buffering hints honored. Other destinations (Redshift, OpenSearch, Splunk, HTTP endpoint) round-trip configuration. Server-side encryption (Start/StopDeliveryStreamEncryption) persists and surfaces in DescribeDeliveryStream. |
| Glue | 269 | JSON 1.1 | Full | Partial | Full control plane: Data Catalog (databases, tables, partitions with GetPartitions Expression pruning), jobs, crawlers, classifiers, connections, triggers, workflows, blueprints, dev endpoints, schema registry, interactive sessions, ML transforms, data quality, user-defined functions, usage profiles, column statistics, and tagging. Status transitions are real (crawler READY↔RUNNING, trigger/workflow/run lifecycles). Job/crawler/Spark execution itself is synthesized — fakecloud is not a Spark engine. |
| Organizations | 63 | JSON 1.1 | Full | Full | Full org tree (roots, OUs, accounts), policies with SCP enforcement, handshakes, delegated administrators, service access, tagging, and a resource policy. Billing responsibility transfers ride handshake-backed records. CreateAccount transitions IN_PROGRESS -> SUCCEEDED after a short synthetic delay. |
| EC2 | 775 | ec2Query | Full | Partial | Full 775-op control plane: VPCs, subnets, security groups, route tables, gateways, ENIs, instances, EBS volumes/snapshots, AMIs (+ watermarks), network ACLs, VPC peering/endpoints, flow logs, launch templates, spot/fleet, capacity/reserved/dedicated hosts, transit gateways (+ multicast/peering/metering/policy-table entries), VPN + Client VPN, IPAM, Verified Access, Network Insights, Outpost/local-gateway/CoIP, and Instance Connect. Instances run as real containers — Docker/Podman by default or native Kubernetes Pods (FAKECLOUD_EC2_BACKEND=k8s) — running user-data at boot, with the instance lifecycle mapped to the container lifecycle and GetConsoleOutput returning the container log; the control plane degrades to metadata-only when no container runtime is present. A few model ops absent from the vendored SDK are validated via raw ec2Query. |
Reading the matrix
- Control plane — the APIs that create, configure, and manage resources (e.g.,
CreateBucket,PutRolePolicy,CreateFunction). fakecloud implements 100% of the control plane for every service listed above. - Data plane — the APIs that process, store, or move actual data (e.g.,
GetObject,InvokeModel,AssumeRole,SendMessage). A service marked Full has a real data plane. A service marked Partial has some real data-plane operations and some synthesized / stubbed ones. A service marked Control-only has no data-plane implementation. - Known limitations — specific gaps that are intentionally synthesized or not yet implemented. These are usually outside the Smithy conformance boundary (the shape is correct, but the behavior is simplified). If a limitation is important for your use case, open an issue or check the service-specific docs for workarounds.
What "100% conformance" means
fakecloud validates every implemented operation against AWS's own Smithy models using a generated test suite with 248,319 variants, all of which pass on every commit. This guarantees that field names, types, required/optional flags, error codes, and HTTP signatures are identical to AWS. It does not guarantee that every operation behaves exactly like AWS in all edge cases — that is what the Data plane and Known limitations columns describe.
If you need a service that is not listed above, the issue tracker and roadmap are the best places to request it.
What fakecloud will never implement
A small set of features depend on real AWS infrastructure, vendor-internal data, or external networks that a local emulator fundamentally cannot replicate. fakecloud is committed to not faking these — we surface a clearly synthesized stand-in instead so tests are not silently wrong.
| Area | Why we cannot implement it |
|---|---|
| Bedrock foundation model weights | The model weights themselves are vendor-proprietary and require real GPU + provider credentials, so fakecloud does not ship a model. Like RDS needing a real Postgres container, Bedrock's data plane works when you wire the backing infra: point FAKECLOUD_BEDROCK_UPSTREAM_URL at a real LLM endpoint (Anthropic, an OpenAI-compatible server, or Ollama) and InvokeModel / Converse / the streaming variants perform genuine inference, translating both directions. Unconfigured, the runtime returns deterministic offline responses with real token counting and fault injection. |
Bedrock Agent semantic responses (InvokeAgent, RetrieveAndGenerate) | Same — depends on real foundation models. Agents return shape-correct synthetic chunks. |
| ACM real certificate authority | Browser-trusted certificates can only be issued by CAs in the OS trust store. fakecloud certificates are self-signed or imported PEM. Trust them locally for testing only. |
| WAFv2 AWS Managed Rule Group content | The actual rules inside AWSManagedRulesCommonRuleSet, AWSManagedRulesAnonymousIpList, etc. are proprietary AWS data. fakecloud accepts the rule-group references and runs structural evaluation, but the rule bodies themselves are not the real AWS content. |
| Real public DNS resolution (Route 53) | Authoritative public DNS requires global anycast network presence. fakecloud's TestDNSAnswer resolves against local state. A real DNS server on UDP/TCP 53 can be opted into for self-contained tests but it is not Internet-facing. |
| CloudFront global edge network | The global/geo CDN is the product and out of scope. fakecloud provides a single-node in-process data plane — enabled distributions serve from their origins locally with path-pattern routing and CustomErrorResponses — but not a distributed edge, per-PoP behavior, or edge caching. Use TestFunction to exercise CloudFront Functions. |
| Real outbound email and SMS (SES, SNS) | Local emulators must not actually send email to inboxes or SMS to phone numbers — that crosses into spam / abuse territory. SES and SNS deliver messages into fakecloud's introspection ledger; an opt-in SMTP submission listener (FAKECLOUD_SES_SMTP_PORT) accepts inbound connections but does not relay outbound to the public Internet. |
| EBS / EFS block storage | Kernel-level storage emulation is out of scope. EFS volumes attached to ECS tasks are mounted as docker volumes with the same logical lifecycle, not real NFS. |
| CloudFront streaming distributions (RTMP) | Service was deprecated by AWS in 2020 and is no longer accepted by their API for new distributions. fakecloud round-trips configuration only and treats RTMP as wontfix. |
If a feature in this list blocks your use case, please open an issue describing what you are trying to test — there is often a smaller, targetable surface that fakecloud can implement instead.
Significant projects on the roadmap
These are gaps that fakecloud can implement but represent significant engineering projects rather than incremental fixes. They are tracked in the public roadmap and are good places to contribute.
| Project | Scope |
|---|---|
| Athena full SQL engine | DataFusion-backed parser + executor for SELECT with WHERE, GROUP BY, aggregates, joins, subqueries, window functions, plus Parquet and JSON SerDes against S3 sources. |
| WAFv2 ManagedRuleGroup framework | Rule expansion engine + bundled OWASP-style stand-in rules + per-rule evaluation against real request headers/bodies. The framework that runs the rules is in scope; the exact AWS rule contents are not (see above). |
| Cognito WebAuthn full attestation verification | CTAP CBOR parser plus signature verification chains for the four common attestation formats (packed, fido-u2f, android-key, tpm). The packed format alone is a smaller targetable batch. |
| ECR cross-registry image replication | Real OCI v2 distribution copy + cross-account auth + region routing when replication rules fire on PutImage. |
| Glue full Job runner | Spark-style execution with partition-aware reads + JDBC connectors. The Glue Job control plane (CreateJob, GetJob, etc.) ships independently. |
| API Gateway v1 full VTL evaluator | $util.* functions, loops, conditionals, escape helpers, full Velocity Template Language coverage in integration request/response templates. |
| CloudFront full edge function pipeline | Origin shield, cache key transforms, in-path CloudFront Functions / Lambda@Edge. The local data plane serves origins but does not run edge functions in the request path yet; the global edge network stays out of scope, and this function pipeline is on the roadmap. |
| CloudWatch Metrics persistence layer | Snapshot store integration so metrics, alarms, and dashboards survive server restarts. |
| Bedrock Knowledge Base ingestion lifecycle | Document chunking + retrieval pipeline. The embedding model itself is out of scope; the framework around it is on the roadmap. |
| AWS X-Ray | 38 |
| AWS AppSync | 74 |
| AWS Amplify | 37 |
| Amazon Textract | 25 |
| Amazon Transcribe | 43 |
| AWS Shield | 36 |
| Amazon Comprehend | 85 |
| Amazon Translate | 19 |
If you want to take one of these on, please open an issue first so we can scope it together.
For a flat listing of every AWS operation grouped by service (not implementation status — that's this page), see the AWS operations index.