Introspection endpoints

Every /_fakecloud/* endpoint for test assertions, simulation, and state control.

fakecloud exposes /_fakecloud/* endpoints for testing behaviors that AWS runs asynchronously (TTL expiration, scheduled rotation, lifecycle, etc.) and for asserting on state from within tests. The first-party SDKs wrap these into ergonomic helpers -- see SDK setup -- but the raw endpoints are documented here as the source of truth.

This page lists every /_fakecloud/* endpoint shipped today: 85 routes across 27 service areas. Endpoints marked NEW were added in the last two weeks. This page lists every /_fakecloud/* endpoint shipped today: 84 routes across 27 service areas. Endpoints marked NEW were added in the last two weeks.

Health and reset

curl http://localhost:4566/_fakecloud/health

{
  "status": "ok",
  "version": "0.13.3",
  "services": [
    "apigatewayv2", "bedrock", "cloudformation", "cognito-idp",
    "dynamodb", "elasticache", "events", "iam", "kinesis", "kms",
    "lambda", "logs", "rds", "s3", "secretsmanager", "ses", "sns",
    "sqs", "ssm", "states", "sts"
  ]
}

ACM

API Gateway v2

Application Auto Scaling

Athena

Bedrock

Bedrock Agent

Bedrock Agent Runtime

CloudFront

CloudWatch

GET /_fakecloud/cloudwatch/alarms response:

{
  "alarms": [
    {
      "accountId": "123456789012",
      "region": "us-east-1",
      "name": "HighErrors",
      "type": "metric",
      "state": "INSUFFICIENT_DATA",
      "stateReason": "Unchecked: Initial alarm creation",
      "stateUpdatedTimestamp": "2026-05-29T00:00:00+00:00",
      "actionsEnabled": true,
      "alarmActions": ["arn:aws:sns:us-east-1:123456789012:ops"],
      "okActions": [],
      "insufficientDataActions": [],
      "namespace": "MyApp",
      "metricName": "Errors",
      "threshold": 10.0,
      "comparisonOperator": "GreaterThanThreshold"
    },
    {
      "accountId": "123456789012",
      "region": "us-east-1",
      "name": "comp",
      "type": "composite",
      "state": "INSUFFICIENT_DATA",
      "stateReason": "",
      "stateUpdatedTimestamp": "2026-05-29T00:00:00+00:00",
      "actionsEnabled": true,
      "alarmActions": [],
      "okActions": [],
      "insufficientDataActions": [],
      "alarmRule": "ALARM(HighErrors)"
    }
  ]
}

GET /_fakecloud/cloudwatch/metrics response:

{
  "metrics": [
    {
      "accountId": "123456789012",
      "region": "us-east-1",
      "namespace": "MyApp",
      "metricName": "Requests",
      "dimensions": [{ "name": "Service", "value": "api" }],
      "datapointCount": 2,
      "latest": { "timestamp": "2026-05-29T00:00:00+00:00", "value": 42.0, "unit": "Count" }
    }
  ]
}

Cognito

DynamoDB

ECR

ECS

ElastiCache

ELBv2

EventBridge

Firehose

GET /_fakecloud/firehose/delivery-streams response:

{
  "deliveryStreams": [
    {
      "accountId": "123456789012",
      "name": "fh-intro",
      "arn": "arn:aws:firehose:us-east-1:123456789012:deliverystream/fh-intro",
      "streamType": "DirectPut",
      "status": "ACTIVE",
      "encryption": { "status": "ENABLED", "keyType": "AWS_OWNED_CMK" },
      "destinationCount": 1,
      "createTimestamp": "2026-05-29T00:00:00+00:00",
      "lastUpdateTimestamp": "2026-05-29T00:00:00+00:00"
    }
  ]
}

When a stream has no encryption configured, encryption is { "status": "DISABLED" } (no keyType/keyArn).

Glue

IAM

KMS

Lambda

Logs

Organizations

GET /_fakecloud/organizations/responsibility-transfers response:

{
  "responsibilityTransfers": [
    {
      "id": "rt-0123456789abcdef0123456789abcdef",
      "arn": "arn:aws:organizations::111111111111:responsibilitytransfer/o-abc123/rt-0123456789abcdef0123456789abcdef",
      "name": "my-billing-transfer",
      "type": "BILLING",
      "status": "REQUESTED",
      "direction": "OUTBOUND",
      "sourceManagementAccountId": "111111111111",
      "sourceManagementAccountEmail": "admin@example.com",
      "targetManagementAccountId": "222222222222",
      "targetManagementAccountEmail": "222222222222@example.com",
      "startTimestamp": "2026-05-29T00:00:00+00:00",
      "endTimestamp": null,
      "activeHandshakeId": "h-0123456789abcdef0123456789abcdef"
    }
  ]
}

endTimestamp and activeHandshakeId are null when not set. The list is empty when no organization exists.

RDS

Route53

S3

Scheduler (EventBridge Scheduler)

Secrets Manager

SES

SNS

SQS

SSM

Step Functions

WAFv2

Conventions

• All endpoints return JSON unless otherwise noted (the SNS cert.pem route returns application/x-pem-file, the Lambda layer-content route returns application/zip, the API Gateway v2 WebSocket route is an upgrade endpoint).
• Path parameters use {snake_case} placeholders.
• POST endpoints that mutate state always accept an empty body when no parameters are required.
• All endpoints are gated behind the fakecloud server itself -- they are never exposed by the real AWS SDKs, so production traffic cannot reach them by accident.

NEW markers reflect endpoints added in the last two weeks (2026-04-27 through 2026-05-11). Older entries with no marker are stable parts of the introspection surface.