# fakecloud — Full Documentation

> fakecloud is a free, open-source local AWS cloud emulator written in Rust. It runs on a single port (4566), requires no account or auth token, and aims for 100% behavioral parity with real AWS across every service, every operation, and every cross-service integration. It is an open-source alternative to LocalStack, which went proprietary in March 2026.

## Overview

fakecloud emulates AWS locally for integration testing and development. It is a single Rust binary (~19 MB, ~300ms startup, ~10 MiB idle memory) — no Docker required to run fakecloud itself, no signup. Point any AWS SDK or the AWS CLI at `http://localhost:4566` with dummy credentials.

**Coverage goal:** 100% of AWS services, each at 100% behavioral conformance, with 100% of cross-service integrations. Approach is depth-first — a service lands when it passes the full Smithy-model test variants and the cross-service wire-ups that matter for it, not when the API surface looks filled in. 105 services (7,505 operations) are shipped today, all at true 100% conformance — 248,557/248,557 generated Smithy variants pass on every commit; more land progressively as they hit the bar.

Key design principles:
- **Depth-first coverage**: every implemented service targets 100% conformance with real AWS, validated on every commit against AWS's own Smithy models — 248,557/248,557 generated test variants pass on every commit, true 100% across every implemented service. CI also runs upstream `hashicorp/terraform-provider-aws` `TestAcc*` suites against fakecloud.
- **Real cross-service integrations**: 30+ service-to-service integrations wire up end-to-end — S3 notifications, SNS fan-out, EventBridge rules, DynamoDB Streams, CloudWatch Logs subscriptions, Cognito triggers, API Gateway -> Lambda, Step Functions task integrations, SES inbound -> S3/SNS/Lambda, and more. Not stubs — the downstream service actually executes.
- **Real execution for stateful services**: Lambda runs function code in real Lambda runtime containers across 23 runtimes. RDS runs real PostgreSQL/MySQL/MariaDB. ElastiCache runs real Redis/Valkey.
- **Zero friction**: no auth tokens, no accounts, no config files needed
- **Test-assertion SDKs** for TypeScript, Python, Go, PHP, Java, Rust, wrapping `/_fakecloud/*` introspection endpoints

fakecloud is NOT a production-ready cloud replacement. It is for integration testing and local development.

## Installation

### Install script (recommended)
```sh
curl -fsSL https://fakecloud.dev/install.sh | bash
```
Works on macOS and Linux, and in CI.

### Homebrew
```sh
brew install fakecloud
```
In homebrew-core (https://formulae.brew.sh/formula/fakecloud), no tap needed.

Options:
```sh
# Install a specific version
curl -fsSL https://fakecloud.dev/install.sh | bash -s -- --version v0.1.0

# Install to a custom directory
curl -fsSL https://fakecloud.dev/install.sh | bash -s -- --install-dir ~/.local/bin
```

### Cargo
```sh
cargo install fakecloud
```

### Docker
```sh
docker run --rm -p 4566:4566 ghcr.io/faiscadev/fakecloud
```

### Docker Compose
```yaml
services:
  fakecloud:
    image: ghcr.io/faiscadev/fakecloud
    ports:
      - "4566:4566"
    environment:
      FAKECLOUD_LOG: info
```

## Running

```sh
fakecloud
```

fakecloud listens at `http://localhost:4566`.

### Configuration

| Flag | Env Var | Default | Description |
|---|---|---|---|
| `--addr` | `FAKECLOUD_ADDR` | `0.0.0.0:4566` | Listen address and port |
| `--region` | `FAKECLOUD_REGION` | `us-east-1` | AWS region to advertise |
| `--account-id` | `FAKECLOUD_ACCOUNT_ID` | `123456789012` | AWS account ID |
| `--log-level` | `FAKECLOUD_LOG` | `info` | Log level (trace, debug, info, warn, error) |
| `--storage-mode` | `FAKECLOUD_STORAGE_MODE` | `memory` | `memory` (default) or `persistent` (mirror all state to `--data-path`) |
| `--data-path` | `FAKECLOUD_DATA_PATH` | — | Directory to persist state to. Required when `--storage-mode=persistent`. |
| `--s3-cache-size` | `FAKECLOUD_S3_CACHE_SIZE` | `268435456` | In-memory LRU cache for S3 object bodies in persistent mode. Default 256 MiB. |

### Persistence

Default is `memory` mode — all state lives in RAM, startup is instant,
shutdown is a no-op. Pass `--storage-mode=persistent --data-path=<dir>` to
mirror all service state to disk and reload on the next launch.

All 105 services persist their durable state: S3, SQS, SNS, EventBridge,
EventBridge Pipes, EventBridge Scheduler, Lambda, DynamoDB, IAM, STS, SSM, Secrets Manager,
CloudWatch Logs, CloudWatch (Metrics & Alarms), KMS, CloudFormation, Cloud Control API, SES,
Cognito User Pools, Cognito Identity, Kinesis, Firehose, RDS, RDS Data API, Aurora DSQL, Resource Groups, Resource Groups Tagging API, ElastiCache, MemoryDB, EKS, AWS Backup, AWS AppConfig,
Step Functions, API Gateway v1, API Gateway v2, Bedrock, Bedrock Agent,
Bedrock Agent Runtime, Bedrock Runtime, ECR, ECS, Elastic Load Balancing v2,
CloudFront, CloudTrail, Route 53, WAF v2, Application Auto Scaling, Athena, ACM, Glue,
EC2, and Organizations. State is
written to disk on every mutation and reloaded on startup. The one exception
is CloudWatch metric datapoints, which are in-memory only (matching how
ephemeral, high-cardinality metric data is treated); CloudWatch alarms,
dashboards, and all other CloudWatch state persist normally.

The data directory is guarded by `fakecloud.version.toml`. A format mismatch
fails startup loudly — there is no auto-migration. S3 object bodies stream
straight to disk; a bounded LRU (`--s3-cache-size`, default 256 MiB) caches
recent reads, and objects larger than `cache-size / 2` bypass the cache so a
single large upload cannot evict everything. Introspection buffers
(`/_fakecloud/*/`) are intentionally not persisted — they reset on restart.

### Health check
```sh
curl http://localhost:4566/_fakecloud/health
# Returns: {"status":"ok","version":"0.6.1","services":["apigateway","cloudformation","cognito-idp","dynamodb","elasticache","events","iam","kinesis","kms","lambda","logs","rds","s3","secretsmanager","ses","sfn","sns","sqs","ssm","sts"]}
```

## Using with AWS SDKs

All AWS SDKs work with fakecloud by setting the endpoint URL to `http://localhost:4566` and using dummy credentials.

### AWS CLI
```sh
export AWS_ACCESS_KEY_ID=test
export AWS_SECRET_ACCESS_KEY=test
export AWS_DEFAULT_REGION=us-east-1

aws --endpoint-url http://localhost:4566 sqs create-queue --queue-name my-queue
aws --endpoint-url http://localhost:4566 s3 mb s3://my-bucket
aws --endpoint-url http://localhost:4566 dynamodb create-table --table-name my-table --attribute-definitions AttributeName=id,AttributeType=S --key-schema AttributeName=id,KeyType=HASH --billing-mode PAY_PER_REQUEST
```

### Python (boto3)
```python
import boto3

sqs = boto3.client('sqs',
    endpoint_url='http://localhost:4566',
    region_name='us-east-1',
    aws_access_key_id='test',
    aws_secret_access_key='test'
)
sqs.create_queue(QueueName='my-queue')
```

### JavaScript/TypeScript (aws-sdk-js v3)
```typescript
import { SQSClient, CreateQueueCommand } from '@aws-sdk/client-sqs';

const client = new SQSClient({
  endpoint: 'http://localhost:4566',
  region: 'us-east-1',
  credentials: { accessKeyId: 'test', secretAccessKey: 'test' },
});
await client.send(new CreateQueueCommand({ QueueName: 'my-queue' }));
```

### Rust (aws-sdk-rust)
```rust
let config = aws_config::defaults(aws_config::BehaviorVersion::latest())
    .endpoint_url("http://localhost:4566")
    .region(aws_config::Region::new("us-east-1"))
    .credentials_provider(aws_credential_types::Credentials::new("test", "test", None, None, "test"))
    .load()
    .await;
let client = aws_sdk_sqs::Client::new(&config);
client.create_queue().queue_name("my-queue").send().await.unwrap();
```

### Go (aws-sdk-go-v2)
```go
cfg, _ := config.LoadDefaultConfig(context.TODO(),
    config.WithRegion("us-east-1"),
    config.WithCredentialsProvider(credentials.NewStaticCredentialsProvider("test", "test", "")),
)
client := sqs.NewFromConfig(cfg, func(o *sqs.Options) {
    o.BaseEndpoint = aws.String("http://localhost:4566")
})
```

## Supported Services — Full Reference

### SQS (23 actions)

CreateQueue, DeleteQueue, ListQueues, GetQueueUrl, GetQueueAttributes, SetQueueAttributes, SendMessage, SendMessageBatch, ReceiveMessage, DeleteMessage, DeleteMessageBatch, PurgeQueue, ChangeMessageVisibility, ChangeMessageVisibilityBatch, ListQueueTags, TagQueue, UntagQueue, AddPermission, RemovePermission, ListDeadLetterSourceQueues

Features: real MD5 hashing, long polling (WaitTimeSeconds), FIFO queues with message group ordering and content-based deduplication, dead-letter queues, message attributes with MD5 computation, batch operations, system attribute filtering.

Protocol: Query (form-encoded body, `Action` parameter, XML responses)

### SNS (42 actions)

**Topics:** CreateTopic, DeleteTopic, ListTopics, GetTopicAttributes, SetTopicAttributes
**Subscriptions:** Subscribe, ConfirmSubscription, Unsubscribe, ListSubscriptions, ListSubscriptionsByTopic, GetSubscriptionAttributes, SetSubscriptionAttributes
**Publishing:** Publish, PublishBatch
**Tags & Permissions:** TagResource, UntagResource, ListTagsForResource, AddPermission, RemovePermission
**Platform Applications:** CreatePlatformApplication, DeletePlatformApplication, GetPlatformApplicationAttributes, SetPlatformApplicationAttributes, ListPlatformApplications
**Platform Endpoints:** CreatePlatformEndpoint, DeleteEndpoint, GetEndpointAttributes, SetEndpointAttributes, ListEndpointsByPlatformApplication
**SMS:** SetSMSAttributes, GetSMSAttributes, CheckIfPhoneNumberIsOptedOut, ListPhoneNumbersOptedOut, OptInPhoneNumber

Features: SQS fan-out delivery, HTTP/HTTPS endpoint delivery, subscription filter policies (exact match, prefix, anything-but, numeric, exists), platform application and endpoint management.

Protocol: Query (form-encoded body, `Action` parameter, XML responses)

### EventBridge (57 actions)

**Event Buses:** CreateEventBus, DeleteEventBus, ListEventBuses, DescribeEventBus
**Rules:** PutRule, DeleteRule, ListRules, DescribeRule, EnableRule, DisableRule, ListRuleNamesByTarget
**Targets:** PutTargets, RemoveTargets, ListTargetsByRule
**Events:** PutEvents
**Permissions:** PutPermission, RemovePermission
**Tags:** TagResource, UntagResource, ListTagsForResource
**Archives:** CreateArchive, DescribeArchive, ListArchives, UpdateArchive, DeleteArchive
**Connections:** CreateConnection, DescribeConnection, ListConnections, UpdateConnection, DeleteConnection
**API Destinations:** CreateApiDestination, DescribeApiDestination, ListApiDestinations, UpdateApiDestination, DeleteApiDestination
**Replays:** StartReplay, DescribeReplay, ListReplays, CancelReplay
**Partner Event Sources:** CreatePartnerEventSource, DescribePartnerEventSource

Features: pattern-based rules (nested fields, numeric comparisons, prefix, exists, anything-but), scheduled rules (rate and cron) that fire on a background timer, targets deliver to SNS and SQS, archives with replay, connections and API destinations.

Protocol: JSON (JSON body, `X-Amz-Target` header, JSON responses)

### EventBridge Scheduler (12 actions)

CreateSchedule, GetSchedule, UpdateSchedule, DeleteSchedule, ListSchedules, CreateScheduleGroup, GetScheduleGroup, DeleteScheduleGroup, ListScheduleGroups, TagResource, UntagResource, ListTagsForResource.

Features: `at`, `rate`, and `cron` expressions; SQS targets; DLQ routing; one-shot schedules with self-delete.

Protocol: REST + JSON

### IAM (176 actions) + STS (11 actions)

**Users:** CreateUser, GetUser, DeleteUser, ListUsers, UpdateUser, TagUser, UntagUser, ListUserTags, CreateAccessKey, DeleteAccessKey, ListAccessKeys, UpdateAccessKey, GetAccessKeyLastUsed, CreateLoginProfile, GetLoginProfile, UpdateLoginProfile, DeleteLoginProfile, AttachUserPolicy, DetachUserPolicy, ListAttachedUserPolicies, PutUserPolicy, GetUserPolicy, DeleteUserPolicy, ListUserPolicies
**Roles:** CreateRole, GetRole, DeleteRole, ListRoles, UpdateRole, UpdateRoleDescription, UpdateAssumeRolePolicy, TagRole, UntagRole, ListRoleTags, PutRolePermissionsBoundary, DeleteRolePermissionsBoundary, AttachRolePolicy, DetachRolePolicy, ListAttachedRolePolicies, PutRolePolicy, GetRolePolicy, DeleteRolePolicy, ListRolePolicies, CreateServiceLinkedRole, DeleteServiceLinkedRole, GetServiceLinkedRoleDeletionStatus
**Groups:** CreateGroup, GetGroup, DeleteGroup, ListGroups, UpdateGroup, AddUserToGroup, RemoveUserFromGroup, ListGroupsForUser, PutGroupPolicy, GetGroupPolicy, DeleteGroupPolicy, ListGroupPolicies, AttachGroupPolicy, DetachGroupPolicy, ListAttachedGroupPolicies
**Policies:** CreatePolicy, GetPolicy, DeletePolicy, ListPolicies, TagPolicy, UntagPolicy, ListPolicyTags, CreatePolicyVersion, GetPolicyVersion, ListPolicyVersions, DeletePolicyVersion, SetDefaultPolicyVersion, ListEntitiesForPolicy
**Instance Profiles:** CreateInstanceProfile, GetInstanceProfile, DeleteInstanceProfile, ListInstanceProfiles, AddRoleToInstanceProfile, RemoveRoleFromInstanceProfile, ListInstanceProfilesForRole, TagInstanceProfile, UntagInstanceProfile, ListInstanceProfileTags
**Identity Providers:** CreateSAMLProvider, GetSAMLProvider, DeleteSAMLProvider, ListSAMLProviders, UpdateSAMLProvider, CreateOpenIDConnectProvider, GetOpenIDConnectProvider, DeleteOpenIDConnectProvider, ListOpenIDConnectProviders, UpdateOpenIDConnectProviderThumbprint, AddClientIDToOpenIDConnectProvider, RemoveClientIDFromOpenIDConnectProvider, TagOpenIDConnectProvider, UntagOpenIDConnectProvider, ListOpenIDConnectProviderTags
**Certificates:** UploadServerCertificate, GetServerCertificate, DeleteServerCertificate, ListServerCertificates, UploadSigningCertificate, ListSigningCertificates, UpdateSigningCertificate, DeleteSigningCertificate
**SSH Keys:** UploadSSHPublicKey, GetSSHPublicKey, ListSSHPublicKeys, UpdateSSHPublicKey, DeleteSSHPublicKey
**MFA:** CreateVirtualMFADevice, DeleteVirtualMFADevice, ListVirtualMFADevices, EnableMFADevice, DeactivateMFADevice, ListMFADevices
**Account:** GetAccountSummary, GetAccountAuthorizationDetails, CreateAccountAlias, DeleteAccountAlias, ListAccountAliases, UpdateAccountPasswordPolicy, GetAccountPasswordPolicy, DeleteAccountPasswordPolicy, GenerateCredentialReport, GetCredentialReport
**STS:** GetCallerIdentity, AssumeRole, AssumeRoleWithWebIdentity, AssumeRoleWithSAML, GetSessionToken, GetFederationToken, GetAccessKeyInfo

Protocol: Query (form-encoded body, `Action` parameter, XML responses)

### SSM (146 actions)

**Parameters:** PutParameter, GetParameter, GetParameters, GetParametersByPath, DeleteParameter, DeleteParameters, DescribeParameters, GetParameterHistory, LabelParameterVersion, UnlabelParameterVersion
**Tags:** AddTagsToResource, RemoveTagsFromResource, ListTagsForResource
**Documents:** CreateDocument, GetDocument, DeleteDocument, UpdateDocument, DescribeDocument, UpdateDocumentDefaultVersion, ListDocuments, DescribeDocumentPermission, ModifyDocumentPermission
**Commands:** SendCommand, ListCommands, GetCommandInvocation, ListCommandInvocations, CancelCommand
**Maintenance Windows:** CreateMaintenanceWindow, DescribeMaintenanceWindows, GetMaintenanceWindow, DeleteMaintenanceWindow, UpdateMaintenanceWindow, RegisterTargetWithMaintenanceWindow, DeregisterTargetFromMaintenanceWindow, DescribeMaintenanceWindowTargets, RegisterTaskWithMaintenanceWindow, DeregisterTaskFromMaintenanceWindow, DescribeMaintenanceWindowTasks
**Patch Baselines:** CreatePatchBaseline, DeletePatchBaseline, DescribePatchBaselines, GetPatchBaseline, RegisterPatchBaselineForPatchGroup, DeregisterPatchBaselineForPatchGroup, GetPatchBaselineForPatchGroup, DescribePatchGroups

Features: String/StringList/SecureString types, automatic versioning, parameter history, hierarchical path queries, pagination, labels.

Protocol: JSON (JSON body, `X-Amz-Target` header, JSON responses)

### S3 (107 actions)

**Buckets:** ListBuckets, CreateBucket, DeleteBucket, HeadBucket, GetBucketLocation
**Objects:** PutObject, GetObject, DeleteObject, HeadObject, CopyObject, DeleteObjects, ListObjectsV2, ListObjects, ListObjectVersions, GetObjectAttributes, RestoreObject
**Object Properties:** PutObjectTagging, GetObjectTagging, DeleteObjectTagging, PutObjectAcl, GetObjectAcl, PutObjectRetention, GetObjectRetention, PutObjectLegalHold, GetObjectLegalHold
**Bucket Configuration:** PutBucketTagging, GetBucketTagging, DeleteBucketTagging, PutBucketAcl, GetBucketAcl, PutBucketVersioning, GetBucketVersioning, PutBucketCors, GetBucketCors, DeleteBucketCors, PutBucketNotificationConfiguration, GetBucketNotificationConfiguration, PutBucketWebsite, GetBucketWebsite, DeleteBucketWebsite, PutBucketAccelerateConfiguration, GetBucketAccelerateConfiguration, PutPublicAccessBlock, GetPublicAccessBlock, DeletePublicAccessBlock, PutBucketEncryption, GetBucketEncryption, DeleteBucketEncryption, PutBucketLifecycleConfiguration, GetBucketLifecycleConfiguration, DeleteBucketLifecycleConfiguration, PutBucketLogging, GetBucketLogging, PutBucketPolicy, GetBucketPolicy, DeleteBucketPolicy, PutObjectLockConfiguration, GetObjectLockConfiguration, PutBucketReplication, GetBucketReplication, DeleteBucketReplication, PutBucketOwnershipControls, GetBucketOwnershipControls, DeleteBucketOwnershipControls, PutBucketInventoryConfiguration, GetBucketInventoryConfiguration, DeleteBucketInventoryConfiguration
**Multipart Uploads:** CreateMultipartUpload, UploadPart, UploadPartCopy, CompleteMultipartUpload, AbortMultipartUpload, ListParts, ListMultipartUploads

Features: path-style addressing, prefix/delimiter listing, pagination (including ListBuckets v2 with `prefix`, `bucket-region`, `max-buckets`, `continuation-token`), user metadata, multipart uploads, versioning, CORS, bucket notifications (SNS/SQS delivery), lifecycle rules with background expiration, object lock (retention and legal hold), encryption, replication config, website config.

Protocol: REST (HTTP method + path-based routing, XML responses)

### DynamoDB (57 actions)

Tables, items, transactions (TransactWriteItems, TransactGetItems), PartiQL (ExecuteStatement, BatchExecuteStatement), backups, global tables, streams, secondary indexes. Standard DynamoDB JSON wire format.

Protocol: JSON (JSON body, `X-Amz-Target` header, JSON responses)

### Lambda (70 actions)

CreateFunction, GetFunction, DeleteFunction, ListFunctions, Invoke, PublishVersion, CreateEventSourceMapping, ListEventSourceMappings, GetEventSourceMapping, DeleteEventSourceMapping

Features: real code execution via Docker containers (23 runtimes supported), event source mappings for SQS polling.

Protocol: REST (HTTP method + path-based routing, JSON responses)

### Secrets Manager (23 actions)

Full secret lifecycle with versioning, soft delete, rotation with Lambda, replication, and resource policies.

Features: secret versioning with AWSCURRENT/AWSPREVIOUS stage tracking, soft delete with configurable recovery window, secret restoration, rotation via Lambda invocation.

Protocol: JSON (JSON body, `X-Amz-Target` header, JSON responses)

### CloudWatch Logs (113 actions)

Full log management with groups, streams, filtering, deliveries, transformers, query language, and anomaly detection.

Features: log groups with log streams, event storage and retrieval, filter pattern matching, retention policies, metric filters, subscription filters, deliveries, transformers, anomaly detection.

Protocol: JSON (JSON body, `X-Amz-Target` header, JSON responses)

### KMS (53 actions)

Full key management with encryption, aliases, grants, real ECDH, and key import.

Features: real envelope encryption, key enable/disable/deletion scheduling, alias resolution, grants, custom key stores, key import, ECDH key agreement.

Protocol: JSON (JSON body, `X-Amz-Target` header, JSON responses)

### CloudFormation (90 actions)

CreateStack, DeleteStack, DescribeStacks, ListStacks, ListStackResources, DescribeStackResources, UpdateStack, GetTemplate

Features: JSON and YAML template parsing, resource provisioning into existing services, stack update with diff-based resource create/delete, Ref/Fn::Sub/Fn::Join intrinsic functions.

Supported resource types: AWS::SQS::Queue, AWS::SNS::Topic, AWS::SNS::Subscription, AWS::SSM::Parameter, AWS::IAM::Role, AWS::IAM::Policy, AWS::S3::Bucket, AWS::Events::Rule, AWS::DynamoDB::Table, AWS::Logs::LogGroup.

Protocol: Query (form-encoded body, `Action` parameter, XML responses)

### Cloud Control API (8 actions)

CreateResource, GetResource, UpdateResource, DeleteResource, ListResources, GetResourceRequestStatus, ListResourceRequests, CancelResourceRequest

Features: uniform CRUD-L interface over CloudFormation resource types, driving the same real provisioners (container-backed resources included). RFC 6902 JSON Patch (`PatchDocument`) updates, ClientToken idempotency, request tracking via ProgressEvent tokens.

Protocol: JSON 1.0 (JSON body, `X-Amz-Target` header, JSON responses)

### SES (111 actions)

**SES v2** (97 actions, REST protocol): identities, templates, configuration sets, contact lists, contacts, send email, tagging, suppression list, event destinations, identity policies, DKIM/feedback/mail-from attributes, config set options, custom verification email templates, template rendering, dedicated IP pools and IPs, multi-region endpoints, account settings, import/export jobs.

**SES v1 inbound** (14 actions, Query protocol): CreateReceiptRuleSet, DescribeReceiptRuleSet, DeleteReceiptRuleSet, ListReceiptRuleSets, SetActiveReceiptRuleSet, CreateReceiptRule, DescribeReceiptRule, UpdateReceiptRule, DeleteReceiptRule, ReorderReceiptRule, CreateReceiptFilter, DescribeReceiptFilter, DeleteReceiptFilter, ListReceiptFilters.

Features: email event fanout to SNS topics and EventBridge buses via configured event destinations, mailbox simulator (bounce@simulator.amazonses.com, complaint@, suppressionlist@), inbound email pipeline via /_fakecloud/ses/inbound endpoint that evaluates receipt rules and executes S3/SNS/Lambda actions.

### Cognito User Pools (122 actions)

User pool management, app clients, user management, groups, authentication flows, password and session management, MFA/software tokens, identity providers, resource servers, domains, device management, tags, and import jobs.

Features: user pools with configurable policies, app client CRUD, user signup/confirmation/admin-create, authentication with USER_PASSWORD_AUTH and ADMIN_NO_SRP_AUTH flows, group management with precedence, MFA with software TOTP, identity provider federation (SAML, OIDC, social), resource servers with custom scopes, custom and managed domain configuration, device tracking, user import jobs.

Protocol: JSON (JSON body, `X-Amz-Target` header, JSON responses)

### Kinesis (39 actions)

CreateStream, DescribeStream, DescribeStreamSummary, ListStreams, DeleteStream, GetRecords, GetShardIterator, PutRecord, PutRecords, AddTagsToStream, ListTagsForStream, RemoveTagsFromStream, IncreaseStreamRetentionPeriod, DecreaseStreamRetentionPeriod

Features: stream creation and deletion, shard iterators and record reads, batched writes, retention period updates, and stream tagging.

Protocol: JSON (JSON body, `X-Amz-Target` header, JSON responses)

### RDS (163 actions)

AddTagsToResource, CreateDBInstance, CreateDBInstanceReadReplica, CreateDBParameterGroup, CreateDBSnapshot, CreateDBSubnetGroup, DeleteDBInstance, DeleteDBParameterGroup, DeleteDBSnapshot, DeleteDBSubnetGroup, DescribeDBEngineVersions, DescribeDBInstances, DescribeDBParameterGroups, DescribeDBSnapshots, DescribeDBSubnetGroups, DescribeOrderableDBInstanceOptions, ListTagsForResource, ModifyDBInstance, ModifyDBParameterGroup, RebootDBInstance, RemoveTagsFromResource, RestoreDBInstanceFromDBSnapshot

Features: DB instance lifecycle (PostgreSQL, MySQL, MariaDB via Docker), read replicas, snapshots and restores, parameter groups, subnet groups, engine and version discovery, orderable instance options, modification and reboot flows, tagging.

Protocol: Query (form-encoded body, `Action` parameter, XML responses)

### ElastiCache (75 actions)

AddTagsToResource, CreateCacheCluster, CreateGlobalReplicationGroup, CreateCacheSubnetGroup, CreateReplicationGroup, CreateServerlessCache, CreateServerlessCacheSnapshot, CreateSnapshot, CreateUser, CreateUserGroup, DecreaseReplicaCount, DeleteCacheCluster, DeleteGlobalReplicationGroup, DeleteCacheSubnetGroup, DeleteReplicationGroup, DeleteServerlessCache, DeleteServerlessCacheSnapshot, DeleteSnapshot, DeleteUser, DeleteUserGroup, DescribeCacheClusters, DescribeCacheEngineVersions, DescribeGlobalReplicationGroups, DescribeCacheParameterGroups, DescribeReservedCacheNodes, DescribeReservedCacheNodesOfferings, DescribeCacheSubnetGroups, DescribeEngineDefaultParameters, DescribeReplicationGroups, DescribeServerlessCaches, DescribeServerlessCacheSnapshots, DescribeSnapshots, DescribeUserGroups, DescribeUsers, DisassociateGlobalReplicationGroup, FailoverGlobalReplicationGroup, IncreaseReplicaCount, ListTagsForResource, ModifyCacheSubnetGroup, ModifyGlobalReplicationGroup, ModifyReplicationGroup, ModifyServerlessCache, RemoveTagsFromResource, TestFailover

Features: cache clusters, replication groups, global replication groups, serverless caches and snapshots, subnet groups, users and user groups, failover and replica-count changes, tagging, and Docker-backed Redis and Valkey for implemented creation flows.

Protocol: Query (form-encoded body, `Action` parameter, XML responses)

### MemoryDB (45 actions)

BatchUpdateCluster, CopySnapshot, CreateACL, CreateCluster, CreateMultiRegionCluster, CreateParameterGroup, CreateSnapshot, CreateSubnetGroup, CreateUser, DeleteACL, DeleteCluster, DeleteMultiRegionCluster, DeleteParameterGroup, DeleteSnapshot, DeleteSubnetGroup, DeleteUser, DescribeACLs, DescribeClusters, DescribeEngineVersions, DescribeEvents, DescribeMultiRegionClusters, DescribeMultiRegionParameterGroups, DescribeMultiRegionParameters, DescribeParameterGroups, DescribeParameters, DescribeReservedNodes, DescribeReservedNodesOfferings, DescribeServiceUpdates, DescribeSnapshots, DescribeSubnetGroups, DescribeUsers, FailoverShard, ListAllowedMultiRegionClusterUpdates, ListAllowedNodeTypeUpdates, ListTags, PurchaseReservedNodesOffering, ResetParameterGroup, TagResource, UntagResource, UpdateACL, UpdateCluster, UpdateMultiRegionCluster, UpdateParameterGroup, UpdateSubnetGroup, UpdateUser

Features: full Redis/Valkey control plane — clusters with shard/replica topology (`NumShards` 1-500, `NumReplicasPerShard` 0-5), ACLs and users (a default `open-access` ACL and `default` user seeded per account), parameter and subnet groups, snapshots capturing cluster configuration, multi-region clusters, and reserved nodes. Account-partitioned and persisted; clusters transition `creating` -> `available` on describe. Redis/Valkey data-plane container backing is a follow-up.

Protocol: JSON 1.1 (awsJson1.1, `X-Amz-Target: AmazonMemoryDB.<Action>`)

### EKS (65 actions, complete)

CreateCluster, DescribeCluster, ListClusters, DeleteCluster, UpdateClusterConfig, UpdateClusterVersion, DescribeUpdate, ListUpdates, TagResource, UntagResource, ListTagsForResource, CreateNodegroup, DescribeNodegroup, ListNodegroups, DeleteNodegroup, UpdateNodegroupConfig, UpdateNodegroupVersion, CreateFargateProfile, DescribeFargateProfile, ListFargateProfiles, DeleteFargateProfile, CreateAddon, DescribeAddon, ListAddons, DeleteAddon, UpdateAddon, DescribeAddonVersions, DescribeAddonConfiguration, CreateAccessEntry, DescribeAccessEntry, ListAccessEntries, DeleteAccessEntry, UpdateAccessEntry, AssociateAccessPolicy, DisassociateAccessPolicy, ListAssociatedAccessPolicies, ListAccessPolicies, AssociateIdentityProviderConfig, DisassociateIdentityProviderConfig, DescribeIdentityProviderConfig, ListIdentityProviderConfigs, CreatePodIdentityAssociation, DescribePodIdentityAssociation, ListPodIdentityAssociations, UpdatePodIdentityAssociation, DeletePodIdentityAssociation, DescribeInsight, ListInsights, DescribeInsightsRefresh, StartInsightsRefresh, AssociateEncryptionConfig, CancelUpdate, DeregisterCluster, RegisterCluster, DescribeClusterVersions, CreateCapability, DeleteCapability, DescribeCapability, ListCapabilities, UpdateCapability, CreateEksAnywhereSubscription, DeleteEksAnywhereSubscription, DescribeEksAnywhereSubscription, ListEksAnywhereSubscriptions, UpdateEksAnywhereSubscription

Features: Elastic Kubernetes Service control plane. Cluster lifecycle with `roleArn`/`resourcesVpcConfig`/`version` (default 1.31) and a `map<String,String>` tag shape; clusters transition `CREATING` -> `ACTIVE` on describe. Config and version updates mint tracked `Update` records (`InProgress` -> `Successful` on describe) surfaced via DescribeUpdate/ListUpdates. Managed node groups (`nodeRole`/`subnets`/`scalingConfig`, config + version updates) and Fargate profiles (`podExecutionRoleArn`/`selectors`) with their own `CREATING` -> `ACTIVE` transitions and update tracking. Add-ons (`addonName`/`addonVersion`/`serviceAccountRoleArn`/`configurationValues`, tracked version updates, plus a DescribeAddonVersions catalogue for vpc-cni/coredns/kube-proxy/aws-ebs-csi-driver/aws-efs-csi-driver and DescribeAddonConfiguration schemas). Access entries (`principalArn`/`kubernetesGroups`/`type`, access-policy association with cluster/namespace `accessScope`, and a ListAccessPolicies catalogue of the AmazonEKS* cluster-access policies). OIDC identity-provider configs (Associate/Disassociate mint tracked cluster Updates; Describe/List) and pod-identity associations (`namespace`/`serviceAccount`/`roleArn`, `a-`-prefixed associationId, upsert Update). Upgrade insights (seeded PASSING UPGRADE_READINESS findings + refresh), capabilities, connected-cluster register/deregister (`connectorConfig`), AssociateEncryptionConfig + CancelUpdate (tracked Updates), a DescribeClusterVersions catalogue (Kubernetes 1.28-1.32 with support windows), and account-scoped EKS Anywhere subscriptions. Complete 65/65 op surface. Account-partitioned and persisted; no real Kubernetes API-server endpoint.

Protocol: REST (restJson1, path-based routing, JSON responses)

### AWS Backup (109 actions, complete)

CreateBackupPlan, CreateBackupSelection, CreateBackupVault, CreateFramework, CreateLegalHold, CreateLogicallyAirGappedBackupVault, CreateReportPlan, CreateRestoreAccessBackupVault, CreateRestoreTestingPlan, CreateRestoreTestingSelection, CreateTieringConfiguration, DeleteBackupPlan, DeleteBackupSelection, DeleteBackupVault, DeleteBackupVaultAccessPolicy, DeleteBackupVaultLockConfiguration, DeleteBackupVaultNotifications, DeleteFramework, DeleteRecoveryPoint, DeleteReportPlan, DeleteRestoreTestingPlan, DeleteRestoreTestingSelection, DeleteTieringConfiguration, DescribeBackupJob, DescribeBackupVault, DescribeCopyJob, DescribeFramework, DescribeGlobalSettings, DescribeProtectedResource, DescribeRecoveryPoint, DescribeRegionSettings, DescribeReportJob, DescribeReportPlan, DescribeRestoreJob, DescribeScanJob, AssociateBackupVaultMpaApprovalTeam, DisassociateBackupVaultMpaApprovalTeam, DisassociateRecoveryPoint, DisassociateRecoveryPointFromParent, ExportBackupPlanTemplate, GetBackupPlan, GetBackupPlanFromJSON, GetBackupPlanFromTemplate, GetBackupSelection, GetBackupVaultAccessPolicy, GetBackupVaultNotifications, GetLegalHold, GetPITRMalwareScanResults, GetRecoveryPointIndexDetails, GetRecoveryPointRestoreMetadata, GetRestoreJobMetadata, GetRestoreTestingInferredMetadata, GetRestoreTestingPlan, GetRestoreTestingSelection, GetSupportedResourceTypes, GetTieringConfiguration, ListBackupJobs, ListBackupJobSummaries, ListBackupPlans, ListBackupPlanTemplates, ListBackupPlanVersions, ListBackupSelections, ListBackupVaults, ListCopyJobs, ListCopyJobSummaries, ListFrameworks, ListIndexedRecoveryPoints, ListLegalHolds, ListProtectedResources, ListProtectedResourcesByBackupVault, ListRecoveryPointsByBackupVault, ListRecoveryPointsByLegalHold, ListRecoveryPointsByResource, ListReportJobs, ListReportPlans, ListRestoreAccessBackupVaults, ListRestoreJobs, ListRestoreJobsByProtectedResource, ListRestoreJobSummaries, ListRestoreTestingPlans, ListRestoreTestingSelections, ListScanJobs, ListScanJobSummaries, ListTags, ListTieringConfigurations, PutBackupVaultAccessPolicy, PutBackupVaultLockConfiguration, PutBackupVaultNotifications, PutRestoreValidationResult, RevokeRestoreAccessBackupVault, StartBackupJob, StartCopyJob, StartReportJob, StartRestoreJob, StartScanJob, StopBackupJob, TagResource, UntagResource, UpdateBackupPlan, UpdateFramework, UpdateGlobalSettings, UpdateRecoveryPointIndexSettings, UpdateRecoveryPointLifecycle, UpdateRegionSettings, UpdateReportPlan, UpdateRestoreTestingPlan, UpdateRestoreTestingSelection, UpdateTieringConfiguration

Features: AWS Backup control plane (no real backup engine; models the AWS management API, matching LocalStack Community's control-plane treatment). Backup plans persist with versions (`ListBackupPlanVersions`) and backup selections; vaults come in three types (standard, logically-air-gapped, restore-access) with notifications, access policies, and vault-lock configuration. `StartBackupJob` records a job (progressed `RUNNING` -> `COMPLETED` on describe) and a synthetic recovery point in the target vault that `DescribeRecoveryPoint` resolves, making the resource visible through `DescribeProtectedResource` / `ListRecoveryPointsByResource`. Copy / restore / scan jobs settle the same way. Frameworks and report plans (with report jobs) settle to a `COMPLETED` deployment status; legal holds create/get/cancel; restore-testing plans + selections and tiering configurations round-trip. Account-scoped global + region (opt-in) settings, resource tagging, and the supported-resource-type catalogue. Validation mirrors the model (`BackupVaultName` `^[a-zA-Z0-9\-\_]{2,50}$`, framework/report-plan names `^[a-zA-Z][_a-zA-Z0-9]*$`, `MaxResults` 1-1000, enum filters). Complete 109/109 op surface, account-partitioned and persisted.

Protocol: REST (restJson1, path-based routing, JSON responses)

### AWS AppConfig (58 actions, complete)

CreateApplication, GetApplication, UpdateApplication, DeleteApplication, ListApplications, CreateEnvironment, GetEnvironment, UpdateEnvironment, DeleteEnvironment, ListEnvironments, CreateConfigurationProfile, GetConfigurationProfile, UpdateConfigurationProfile, DeleteConfigurationProfile, ListConfigurationProfiles, ValidateConfiguration, CreateHostedConfigurationVersion, GetHostedConfigurationVersion, DeleteHostedConfigurationVersion, ListHostedConfigurationVersions, CreateDeploymentStrategy, GetDeploymentStrategy, UpdateDeploymentStrategy, DeleteDeploymentStrategy, ListDeploymentStrategies, StartDeployment, GetDeployment, StopDeployment, ListDeployments, GetConfiguration, CreateExtension, GetExtension, UpdateExtension, DeleteExtension, ListExtensions, CreateExtensionAssociation, GetExtensionAssociation, UpdateExtensionAssociation, DeleteExtensionAssociation, ListExtensionAssociations, CreateExperimentDefinition, GetExperimentDefinition, UpdateExperimentDefinition, DeleteExperimentDefinition, ListExperimentDefinitions, StartExperimentRun, GetExperimentRun, UpdateExperimentRun, StopExperimentRun, ListExperimentRuns, ListExperimentRunEvents, GetAccountSettings, UpdateAccountSettings, TagResource, UntagResource, ListTagsForResource (appconfig); StartConfigurationSession, GetLatestConfiguration (appconfigdata)

Features: One crate serves both AWS model-services behind the shared `appconfig` SigV4 signing name — the 56-op `appconfig` control plane and the 2-op `appconfigdata` data plane (routing splits on the URL path). Applications, environments, and configuration profiles are real, account-partitioned resources; deleting an application cascades to its environments, profiles, and experiments, and deleting a profile cascades to its hosted configuration versions. Hosted configuration versions store the exact request bytes plus `Content-Type` and return them verbatim with the `Application-Id` / `Configuration-Profile-Id` / `Version-Number` / `Content-Type` response headers; `VersionNumber` auto-increments per profile. The four AWS-predefined deployment strategies (`AppConfig.AllAtOnce`, `AppConfig.Linear50PercentEvery30Seconds`, `AppConfig.Canary10Percent20Minutes`, `AppConfig.Linear20PercentEvery6Minutes`) resolve by id alongside custom ones. Deployments settle straight to `COMPLETE` (100% `PercentageComplete`) with an event log so waiters and Terraform observe the terminal state; `DeploymentNumber` auto-increments per environment. Extensions + associations, experiment definitions + runs, account settings, and tagging round-trip. The data plane resolves a `StartConfigurationSession` token through `GetLatestConfiguration` to the latest deployed hosted-config bytes, returned with a `NextPollConfigurationToken`. `@length` / `@range` / enum constraints enforced with `BadRequestException` / `ResourceNotFoundException`. Account-partitioned and persisted (hosted-config bytes survive restart).

Protocol: REST (restJson1, path-based routing, JSON responses)

### Cloud Map (30 actions, complete)

CreateHttpNamespace, CreatePrivateDnsNamespace, CreatePublicDnsNamespace, GetNamespace, ListNamespaces, DeleteNamespace, UpdateHttpNamespace, UpdatePrivateDnsNamespace, UpdatePublicDnsNamespace, GetOperation, ListOperations, CreateService, GetService, ListServices, UpdateService, DeleteService, GetServiceAttributes, UpdateServiceAttributes, DeleteServiceAttributes, RegisterInstance, DeregisterInstance, GetInstance, ListInstances, GetInstancesHealthStatus, UpdateInstanceCustomHealthStatus, DiscoverInstances, DiscoverInstancesRevision, TagResource, UntagResource, ListTagsForResource

Features: full AWS Cloud Map (`servicediscovery`) control plane + discovery API. HTTP, public-DNS, and private-DNS namespaces with `Id` (`ns-...`), ARN, `Properties` (HttpProperties.HttpName; DnsProperties.HostedZoneId + SOA for DNS types), `ServiceCount`, and tags. Services (`srv-...`) carry `NamespaceId`, `DnsConfig` (RoutingPolicy + DnsRecords), `HealthCheckConfig`/`HealthCheckCustomConfig`, `InstanceCount`, and string-map service attributes. Instances register with well-known attributes (AWS_INSTANCE_IPV4/IPV6/PORT/CNAME, validated against the service's DnsConfig record types), carry a health status (custom health via UpdateInstanceCustomHealthStatus), and are looked up by the `DiscoverInstances` data-plane API (resolve namespace + service by name, filter by QueryParameters attribute-equality and a HealthStatus filter defaulting to HEALTHY_OR_ELSE_ALL) with a per-service `InstancesRevision` counter (DiscoverInstancesRevision). Cross-resource tagging (TagResource/UntagResource/ListTagsForResource) over namespace + service ARNs. Follows Cloud Map's asynchronous operation model: namespace create/delete/update, UpdateService, and instance register/deregister return an `OperationId` that settles `SUBMITTED` -> `SUCCESS` on `GetOperation`; CreateService/DeleteService/Get/List/Discover/tag ops are synchronous. Pagination + `Filters` throughout. Account-partitioned and persisted. No DNS/HTTP data plane beyond the discovery API.

Protocol: awsJson1.1 (X-Amz-Target `Route53AutoNaming_v20170314.<Op>`)

### Resource Groups (23 actions)

CreateGroup, GetGroup, GetGroupQuery, UpdateGroup, UpdateGroupQuery, DeleteGroup, ListGroups, GroupResources, UngroupResources, ListGroupResources, SearchResources, GetGroupConfiguration, PutGroupConfiguration, GetTags, Tag, Untag, GetAccountSettings, UpdateAccountSettings, ListGroupingStatuses, StartTagSyncTask, GetTagSyncTask, ListTagSyncTasks, CancelTagSyncTask

Features: resource groups defined by a tag or CloudFormation-stack `ResourceQuery`, or by a service `Configuration` with explicit membership; group lifecycle and pagination, resource-query storage, explicit membership (query-based groups reject explicit `GroupResources`/`UngroupResources`), free-standing `SearchResources`, group configuration, tagging keyed by group ARN, account settings for group lifecycle events, grouping statuses, and tag-sync tasks. Account-partitioned and persisted. Query-based membership resolution across live resources lands with the Resource Groups Tagging API tag index.

Protocol: REST (restJson1, path-based routing, JSON responses)

### Resource Groups Tagging API (9 actions)

GetResources, GetTagKeys, GetTagValues, TagResources, UntagResources, GetComplianceSummary, StartReportCreation, DescribeReportCreation, ListRequiredTags

Features: cross-service tag reads and writes from one endpoint. `GetResources` returns every resource with its tags, honoring `ResourceARNList`, `ResourceTypeFilters` (`service` or `service:type`), `TagFilters`, and pagination; `GetTagKeys`/`GetTagValues` enumerate distinct keys/values. `TagResources`/`UntagResources` apply/remove tags on any ARN (partial failures in `FailedResourcesMap`). `GetComplianceSummary`/`ListRequiredTags` evaluate Organizations tag policies (empty with none in effect). `StartReportCreation`/`DescribeReportCreation` drive the async account-wide tag report. Reads aggregate a cross-service tag-provider registry (each service exposes its live tags) plus tags applied directly through this API; per-service providers roll out incrementally. Account-partitioned and persisted.

Protocol: awsJson1.1 (`X-Amz-Target: ResourceGroupsTaggingAPI_20170126.<Operation>`)

### ECR (58 actions)

Full registry surface — repositories, images (real OCI v2 push/pull via `docker push`/`pull`), lifecycle policies and evaluation, image scanning, pull-through cache rules, registry settings, replication, signing.

Protocol: REST/JSON (control plane) + OCI v2 Distribution (data plane)

### ECS (77 actions)

Clusters, task definitions, real Fargate-style task execution via Docker, services with rolling deployments, task sets (EXTERNAL deployment controller), container instances, capacity providers, attributes, task protection, ECS Exec via `docker exec`, the agent-side Submit*/DiscoverPollEndpoint surface, awslogs forwarding to CloudWatch Logs, secrets[] resolution against SecretsManager + SSM Parameter Store, task role credentials served from /_fakecloud/ecs/creds/{taskId}, tagging.

Protocol: JSON (JSON body, `X-Amz-Target` header, JSON responses)

### Elastic Load Balancing v2 (51 actions)

Full control plane — Application/Network/Gateway load balancer CRUD, target groups + targets + health (synthetic), listeners + rules + certificates, LB/listener/target-group attributes, capacity reservations, mTLS trust stores + revocations, resource policies, IP pools, IP address types, subnets, security groups, SSL policies, tags. ForwardConfig.TargetGroups references on rules and listeners block target group deletion. Data plane (in-process HTTP routing) intentionally not implemented.

Protocol: Query (form-encoded body, `Action` parameter, XML responses)

### Step Functions (37 actions)

CreateStateMachine, DeleteStateMachine, DescribeStateMachine, DescribeStateMachineForExecution, ListStateMachines, UpdateStateMachine, TagResource, UntagResource, ListTagsForResource, StartExecution, DescribeExecution, GetExecutionHistory, ListExecutions, StopExecution

Features: Complete Amazon States Language (ASL) interpreter with all state types (Pass, Task, Choice, Wait, Parallel, Map, Succeed, Fail), error handling with Retry and Catch, cross-service task integrations (Lambda, SQS, SNS, EventBridge, DynamoDB), execution history tracking, and introspection endpoint for test assertions.

Protocol: JSON (JSON body, `X-Amz-Target` header, JSON responses)

### API Gateway v1 / REST APIs (124 actions)

**REST APIs:** CreateRestApi, GetRestApi, GetRestApis, UpdateRestApi, PutRestApi (OpenAPI overwrite/merge), ImportRestApi, DeleteRestApi
**Resources:** CreateResource, GetResource, GetResources, UpdateResource, DeleteResource
**Methods:** PutMethod, GetMethod, UpdateMethod, DeleteMethod
**Method Responses:** PutMethodResponse, GetMethodResponse, UpdateMethodResponse, DeleteMethodResponse
**Integrations:** PutIntegration, GetIntegration, UpdateIntegration, DeleteIntegration (`MOCK`/`HTTP`/`HTTP_PROXY`/`AWS_PROXY` Lambda v1.0 proxy event)
**Integration Responses:** PutIntegrationResponse, GetIntegrationResponse, UpdateIntegrationResponse, DeleteIntegrationResponse
**Deployments:** CreateDeployment, GetDeployment, GetDeployments, UpdateDeployment, DeleteDeployment
**Stages:** CreateStage, GetStage, GetStages, UpdateStage, DeleteStage, FlushStageCache, FlushStageAuthorizersCache
**Models & Validators:** CreateModel, GetModel(s), UpdateModel, DeleteModel, GetModelTemplate, CreateRequestValidator, GetRequestValidator(s), UpdateRequestValidator, DeleteRequestValidator
**Authorizers:** CreateAuthorizer, GetAuthorizer(s), UpdateAuthorizer, DeleteAuthorizer (TOKEN/REQUEST/COGNITO_USER_POOLS)
**API Keys & Usage Plans:** CreateApiKey, GetApiKey(s), UpdateApiKey, DeleteApiKey, CreateUsagePlan, GetUsagePlan(s), UpdateUsagePlan, DeleteUsagePlan, CreateUsagePlanKey, GetUsagePlanKey(s), DeleteUsagePlanKey, GetUsage, UpdateUsage
**VPC Links / Domains:** CreateVpcLink, GetVpcLink(s), UpdateVpcLink, DeleteVpcLink, CreateDomainName, GetDomainName(s), UpdateDomainName, DeleteDomainName, CreateBasePathMapping, GetBasePathMapping(s), UpdateBasePathMapping, DeleteBasePathMapping
**Client Certs / Docs / Gateway Responses:** GenerateClientCertificate, GetClientCertificate(s), UpdateClientCertificate, DeleteClientCertificate, CreateDocumentationPart/Version, GetDocumentationPart(s)/Version(s), UpdateDocumentationPart/Version, DeleteDocumentationPart/Version, PutGatewayResponse, GetGatewayResponse(s), UpdateGatewayResponse, DeleteGatewayResponse
**Other:** GetExport, GetSdk, GetSdkType(s), TagResource, UntagResource, GetTags, GetAccount, UpdateAccount, TestInvokeMethod, TestInvokeAuthorizer

Protocol: REST (URL paths + HTTP methods, HAL+JSON responses with singular `item` collection key)

### API Gateway v2 (103 actions)

**APIs:** CreateApi, DeleteApi, GetApi, GetApis, UpdateApi, ImportApi, ReimportApi, ExportApi
**Routes:** CreateRoute, DeleteRoute, GetRoute, GetRoutes, UpdateRoute, DeleteRouteRequestParameter, DeleteRouteSettings
**Route Responses:** CreateRouteResponse, DeleteRouteResponse, GetRouteResponse, GetRouteResponses, UpdateRouteResponse
**Integrations:** CreateIntegration, DeleteIntegration, GetIntegration, GetIntegrations, UpdateIntegration
**Integration Responses:** CreateIntegrationResponse, DeleteIntegrationResponse, GetIntegrationResponse, GetIntegrationResponses, UpdateIntegrationResponse
**Routing Rules:** CreateRoutingRule, DeleteRoutingRule, GetRoutingRule, ListRoutingRules, PutRoutingRule
**Stages:** CreateStage, DeleteStage, GetStage, GetStages, UpdateStage, DeleteAccessLogSettings
**Deployments:** CreateDeployment, DeleteDeployment, GetDeployment, GetDeployments, UpdateDeployment
**Authorizers:** CreateAuthorizer, DeleteAuthorizer, GetAuthorizer, GetAuthorizers, UpdateAuthorizer, ResetAuthorizersCache
**Domain Names:** CreateDomainName, DeleteDomainName, GetDomainName, GetDomainNames, UpdateDomainName
**API Mappings:** CreateApiMapping, DeleteApiMapping, GetApiMapping, GetApiMappings, UpdateApiMapping
**Models:** CreateModel, DeleteModel, GetModel, GetModels, UpdateModel, GetModelTemplate
**VPC Links:** CreateVpcLink, DeleteVpcLink, GetVpcLink, GetVpcLinks, UpdateVpcLink
**CORS:** DeleteCorsConfiguration
**Tags:** TagResource, UntagResource, GetTags
**Developer Portals:** CreatePortal, DeletePortal, DisablePortal, GetPortal, ListPortals, PreviewPortal, PublishPortal, UpdatePortal
**Portal Products:** CreatePortalProduct, DeletePortalProduct, DeletePortalProductSharingPolicy, GetPortalProduct, GetPortalProductSharingPolicy, ListPortalProducts, PutPortalProductSharingPolicy, UpdatePortalProduct
**Product Pages:** CreateProductPage, DeleteProductPage, GetProductPage, ListProductPages, UpdateProductPage
**Product REST Endpoint Pages:** CreateProductRestEndpointPage, DeleteProductRestEndpointPage, GetProductRestEndpointPage, ListProductRestEndpointPages, UpdateProductRestEndpointPage

Features: HTTP APIs with route-based request handling, path parameters and wildcards (`/users/{userId}`, `/api/*`), Lambda proxy integration v2.0 format, HTTP proxy integration for external endpoints, Mock integration for static responses, CORS configuration, JWT and Lambda authorizers, custom domains + API mappings, request models, routing rules, VPC links, OpenAPI import/reimport/export, full developer portal surface (portals, products, product pages, REST endpoint pages, sharing policies), request history introspection endpoint.

Protocol: REST (HTTP method + path-based routing, JSON responses)

### Bedrock (101 actions) + Bedrock Runtime (10 actions)

**Foundation Models:** ListFoundationModels, GetFoundationModel
**Guardrails:** CreateGuardrail, GetGuardrail, ListGuardrails, UpdateGuardrail, DeleteGuardrail, CreateGuardrailVersion, ApplyGuardrail
**Custom Models:** CreateCustomModel, GetCustomModel, ListCustomModels, DeleteCustomModel
**Custom Model Deployments:** CreateCustomModelDeployment, GetCustomModelDeployment, ListCustomModelDeployments, UpdateCustomModelDeployment, DeleteCustomModelDeployment
**Model Import:** CreateModelImportJob, GetModelImportJob, ListModelImportJobs, GetImportedModel, ListImportedModels, DeleteImportedModel
**Model Copy:** CreateModelCopyJob, GetModelCopyJob, ListModelCopyJobs
**Model Customization:** CreateModelCustomizationJob, GetModelCustomizationJob, ListModelCustomizationJobs, StopModelCustomizationJob
**Provisioned Throughput:** CreateProvisionedModelThroughput, GetProvisionedModelThroughput, ListProvisionedModelThroughputs, UpdateProvisionedModelThroughput, DeleteProvisionedModelThroughput
**Model Invocation Jobs:** CreateModelInvocationJob, GetModelInvocationJob, ListModelInvocationJobs, StopModelInvocationJob
**Evaluation Jobs:** CreateEvaluationJob, GetEvaluationJob, ListEvaluationJobs, StopEvaluationJob, BatchDeleteEvaluationJob
**Inference Profiles:** CreateInferenceProfile, GetInferenceProfile, ListInferenceProfiles, DeleteInferenceProfile
**Prompt Routers:** CreatePromptRouter, GetPromptRouter, ListPromptRouters, DeletePromptRouter
**Marketplace:** CreateMarketplaceModelEndpoint, GetMarketplaceModelEndpoint, ListMarketplaceModelEndpoints, UpdateMarketplaceModelEndpoint, DeleteMarketplaceModelEndpoint, RegisterMarketplaceModelEndpoint, DeregisterMarketplaceModelEndpoint
**Automated Reasoning:** Full CRUD for policies, versions, test cases, build workflows, annotations, and scenarios (24 operations)
**Runtime:** InvokeModel, InvokeModelWithResponseStream, InvokeModelWithBidirectionalStream, Converse, ConverseStream, CountTokens, ApplyGuardrail, StartAsyncInvoke, GetAsyncInvoke, ListAsyncInvokes

Features: Foundation model catalog with 20+ models (Anthropic Claude, Amazon Titan, Meta Llama, Cohere, Mistral), provider-specific response formats, guardrail content evaluation (word, topic, PII detection), model invocation introspection, custom response simulation, event-stream encoding for streaming.

Protocol: REST-JSON (HTTP method + path-based routing, JSON responses)

### CloudFront (147 actions)

**Distributions:** CreateDistribution, GetDistribution, GetDistributionConfig, UpdateDistribution, DeleteDistribution, ListDistributions, ListDistributionsByCachePolicyId, ListDistributionsByOriginRequestPolicyId, ListDistributionsByResponseHeadersPolicyId, ListDistributionsByRealtimeLogConfig, ListDistributionsByWebACLId, ListDistributionsByConnectionMode, ListDistributionsByVPCOriginId, ListDistributionsByAnycastIpListId, AssociateAlias, ListConflictingAliases
**Invalidations:** CreateInvalidation, GetInvalidation, ListInvalidations
**Origin Access Control:** CreateOriginAccessControl, GetOriginAccessControl, GetOriginAccessControlConfig, UpdateOriginAccessControl, DeleteOriginAccessControl, ListOriginAccessControls
**Cache + Origin Request + Response Headers + Continuous Deployment Policies:** full CRUD for each of the four policy types
**CloudFront Functions:** CreateFunction, DescribeFunction, GetFunction, UpdateFunction, PublishFunction, TestFunction, ListFunctions, DeleteFunction
**Public Keys + Key Groups + Key Value Stores:** full CRUD for cookie-signing key material
**Origin Access Identities (legacy):** full CRUD for the older origin-protection model
**Streaming Distributions (legacy RTMP):** full CRUD
**Field-Level Encryption:** configs + profiles + Realtime Log Configs full CRUD
**VPC Origins, Anycast IP Lists, Trust Stores, Resource Policies:** full CRUD
**Connection Groups + Domain Association/DNS Verification + Managed Certificate Details + Promote-Staging Distribution:** full CRUD with ETag/If-Match concurrency
**Tagging + Monitoring Subscriptions**

Features: Full `DistributionConfig` round-trip including origins, cache behaviors, custom error responses, viewer certificates, geo restrictions. ETag-based optimistic concurrency on every mutating operation.

Protocol: REST-XML (HTTP method + path-based routing under `/2020-05-31/`)

### CloudTrail (60 actions)

**Trails:** CreateTrail, GetTrail, UpdateTrail, DeleteTrail, DescribeTrails, ListTrails
**Logging status:** GetTrailStatus, StartLogging, StopLogging
**Event + Insight selectors:** GetEventSelectors, PutEventSelectors, GetInsightSelectors, PutInsightSelectors
**CloudTrail Lake event data stores:** CreateEventDataStore, GetEventDataStore, UpdateEventDataStore, DeleteEventDataStore, ListEventDataStores, RestoreEventDataStore
**Ingestion + federation:** StartEventDataStoreIngestion, StopEventDataStoreIngestion, EnableFederation, DisableFederation
**Channels:** CreateChannel, GetChannel, UpdateChannel, DeleteChannel, ListChannels
**Imports:** StartImport, StopImport, GetImport, ListImports, ListImportFailures
**Lake queries:** StartQuery, DescribeQuery, GetQueryResults, CancelQuery, ListQueries, GenerateQuery, SearchSampleQueries
**Dashboards:** CreateDashboard, GetDashboard, UpdateDashboard, DeleteDashboard, ListDashboards, StartDashboardRefresh
**Resource policies:** PutResourcePolicy, GetResourcePolicy, DeleteResourcePolicy
**Organization delegated admins:** RegisterOrganizationDelegatedAdmin, DeregisterOrganizationDelegatedAdmin
**Event configuration:** GetEventConfiguration, PutEventConfiguration
**Tagging:** AddTags, RemoveTags, ListTags
**Read-only lookups:** LookupEvents, ListPublicKeys, ListInsightsMetricData, ListInsightsData

Features: Trails round-trip `S3BucketName`/`S3KeyPrefix`/`SnsTopicName`/`HomeRegion`/CloudWatch Logs wiring/KMS key/multi-region + organization flags; `CreateTrail` leaves logging off (`IsLogging: false`) until `StartLogging`. Event data stores settle to `ENABLED` synchronously; `DeleteEventDataStore` moves a store to `PENDING_DELETION` and `RestoreEventDataStore` brings it back. Lake queries settle to `FINISHED` with empty result rows. `LookupEvents`, `ListPublicKeys`, and `ListInsightsMetricData` return real, empty result sets — a fake records no activity of its own. `@length`/`@range`/enum constraints validated against the Smithy model. Account-partitioned and persisted. Control-plane only — no event-recording engine, matching how LocalStack Community mocks CloudTrail.

Protocol: awsJson1.1 (`X-Amz-Target: CloudTrail_20131101.<Operation>`)

### Route 53 (71 actions)

**Hosted Zones:** CreateHostedZone, GetHostedZone, DeleteHostedZone, ListHostedZones, ListHostedZonesByName, ListHostedZonesByVPC, GetHostedZoneCount, UpdateHostedZoneComment, UpdateHostedZoneFeatures, GetHostedZoneLimit
**Resource Record Sets:** ChangeResourceRecordSets, ListResourceRecordSets, GetChange, TestDNSAnswer
**Health Checks:** CreateHealthCheck, GetHealthCheck, GetHealthCheckCount, GetHealthCheckLastFailureReason, GetHealthCheckStatus, ListHealthChecks, UpdateHealthCheck, DeleteHealthCheck, GetCheckerIpRanges
**Traffic Policies + Instances:** Create/Get/Delete/List/Update for both, including version increment, list-by-zone, list-by-policy, count
**DNSSEC + KSK:** EnableHostedZoneDNSSEC, DisableHostedZoneDNSSEC, GetDNSSEC, CreateKeySigningKey, GetKeySigningKey, ListKeySigningKeys, ActivateKeySigningKey, DeactivateKeySigningKey, DeleteKeySigningKey
**Query Logging:** CreateQueryLoggingConfig, GetQueryLoggingConfig, ListQueryLoggingConfigs, DeleteQueryLoggingConfig
**CIDR Collections:** CreateCidrCollection, ChangeCidrCollection, ListCidrCollections, ListCidrBlocks, ListCidrLocations, DeleteCidrCollection
**VPC Associations:** AssociateVPCWithHostedZone, DisassociateVPCFromHostedZone, CreateVPCAssociationAuthorization, DeleteVPCAssociationAuthorization, ListVPCAssociationAuthorizations
**Reusable Delegation Sets:** CreateReusableDelegationSet, GetReusableDelegationSet, ListReusableDelegationSets, GetReusableDelegationSetLimit, DeleteReusableDelegationSet
**Geo Locations + Account Limits + Tags:** ListGeoLocations, GetGeoLocation, GetAccountLimit, ChangeTagsForResource, ListTagsForResource, ListTagsForResources

Features: Default SOA + NS records seeded on zone create with AWS-shaped name servers. `INSYNC` change tracking, optimistic concurrency via `HealthCheckVersion` and `CollectionVersion`. Real `HostedZoneNotEmpty`, `HealthCheckInUse`, `DelegationSetInUse`, `InvalidKeySigningKeyStatus` exceptions. Public-zone-only enforcement on query logging.

Protocol: REST-XML under `/2013-04-01/` (HTTP method + URI routing)

### ACM (Certificate Manager) (40 actions)

**Public Certificates:** RequestCertificate, DescribeCertificate, GetCertificate, ListCertificates, SearchCertificates, DeleteCertificate, RenewCertificate, RevokeCertificate
**Imported Certificates:** ImportCertificate (round-trips PEM, supports re-import to same ARN), ExportCertificate (returns cert + chain + key with passphrase)
**Tags:** AddTagsToCertificate, RemoveTagsFromCertificate, ListTagsForCertificate
**Account-wide:** GetAccountConfiguration, PutAccountConfiguration
**Cert Options:** UpdateCertificateOptions (transparency-logging + export prefs)
**Validation:** ResendValidationEmail (only for EMAIL-validated certs), ListCertificateDomainValidations
**Resource tagging:** TagResource, UntagResource, ListTagsForResource
**ACME endpoints:** CreateAcmeEndpoint, DescribeAcmeEndpoint, ListAcmeEndpoints, UpdateAcmeEndpoint, DeleteAcmeEndpoint
**ACME external account bindings:** CreateAcmeExternalAccountBinding, DescribeAcmeExternalAccountBinding, ListAcmeExternalAccountBindings, GetAcmeExternalAccountBindingCredentials, RevokeAcmeExternalAccountBinding, DeleteAcmeExternalAccountBinding
**ACME domain validations:** CreateAcmeDomainValidation, DescribeAcmeDomainValidation, ListAcmeDomainValidations, UpdateAcmeDomainValidation, DeleteAcmeDomainValidation
**ACME accounts:** DescribeAcmeAccount, ListAcmeAccounts, RevokeAcmeAccount

Features: Deterministic synthesized DNS validation records. `IdempotencyToken` dedupe on token + DomainName + SANs (real ACM uses 1-hour window; fakecloud uses exact match for determinism). `RevokeCertificate` only on AMAZON_ISSUED certs. fakecloud does not run real X.509 validation — public certs land at `PENDING_VALIDATION` and stay there until renewed; `Import` flips straight to `ISSUED`.

Protocol: JSON 1.1 (`X-Amz-Target: CertificateManager.<Action>`)

### ACM PCA (23 actions)

**Certificate Authorities:** CreateCertificateAuthority, DescribeCertificateAuthority, ListCertificateAuthorities, UpdateCertificateAuthority, DeleteCertificateAuthority, RestoreCertificateAuthority, GetCertificateAuthorityCsr, ImportCertificateAuthorityCertificate, GetCertificateAuthorityCertificate
**Certificates:** IssueCertificate, GetCertificate, RevokeCertificate
**Audit Reports:** CreateCertificateAuthorityAuditReport, DescribeCertificateAuthorityAuditReport
**Permissions (RAM sharing):** CreatePermission, ListPermissions, DeletePermission
**Resource Policies:** PutPolicy, GetPolicy, DeletePolicy
**Tags:** TagCertificateAuthority, UntagCertificateAuthority, ListTags

Features: Real private CA hierarchy. `CreateCertificateAuthority` mints a genuine CA key pair (RSA 2048/3072/4096, EC P-256/P-384) — a `ROOT` CA self-signs its CSR while a `SUBORDINATE` CA starts `PENDING_CERTIFICATE` and serves a real PEM CSR until its parent-signed chain is installed. `IssueCertificate` signs a real end-entity certificate from the caller's CSR that verifies against the CA (`rcgen`); `GetCertificate` returns the signed PEM + chain. Revocation, audit reports (JSON/CSV), resource-share permissions, and resource policies are implemented. CA private keys are persisted, so certificates issued before a restart still verify afterward (key generation runs on a background task: CA is `CREATING` until the key is ready, then `PENDING_CERTIFICATE`).

Protocol: JSON 1.1 (`X-Amz-Target: ACMPrivateCA.<Action>`)

### Application Auto Scaling (14 actions)

**Scalable Targets:** RegisterScalableTarget, DeregisterScalableTarget, DescribeScalableTargets
**Scaling Policies:** PutScalingPolicy, DescribeScalingPolicies, DeleteScalingPolicy
**Scheduled Actions:** PutScheduledAction, DescribeScheduledActions, DeleteScheduledAction
**Activity + Forecasting:** DescribeScalingActivities, GetPredictiveScalingForecast
**Tags:** TagResource, UntagResource, ListTagsForResource

Features: Supports all 13 documented namespaces (ECS, Lambda, DynamoDB, RDS, ElastiCache, SageMaker, EMR, AppStream, Cassandra, Kafka, Neptune, EC2 Spot Fleet, Comprehend). Step + target-tracking + predictive scaling policies. Scheduled actions with cron / one-shot start/end times + Timezone. `RoleARN` defaults to per-namespace service-linked role ARN. `Deregister` cascades to policies + scheduled actions for the same target. `GetPredictiveScalingForecast` returns deterministic hourly Load + Capacity buckets capped at 168 hours (one week).

Protocol: JSON 1.1 (`X-Amz-Target: AnyScaleFrontendService.<Action>`)

### WAF v2 (55 actions)

**Web ACLs / Rule Groups / IP Sets / Regex Pattern Sets:** Create/Get/List/Update/Delete for each (with `LockToken` optimistic concurrency)
**Capacity:** CheckCapacity (recursive count of statement leaves through `AndStatement`/`OrStatement`/`NotStatement`)
**Web ACL Associations:** AssociateWebACL, DisassociateWebACL, GetWebACLForResource, ListResourcesForWebACL
**API Keys:** CreateAPIKey, DeleteAPIKey, GetDecryptedAPIKey, ListAPIKeys
**Logging:** PutLoggingConfiguration, GetLoggingConfiguration, DeleteLoggingConfiguration, ListLoggingConfigurations
**Permission Policies:** PutPermissionPolicy, GetPermissionPolicy, DeletePermissionPolicy
**Managed Rule Catalog:** ListAvailableManagedRuleGroups + Versions, DescribeManagedRuleGroup, DescribeAllManagedProducts, DescribeManagedProductsByVendor, GetManagedRuleSet, PutManagedRuleSetVersions, UpdateManagedRuleSetVersionExpiryDate, ListManagedRuleSets
**Mobile SDK:** GenerateMobileSdkReleaseUrl, GetMobileSdkRelease, ListMobileSdkReleases
**Tags:** TagResource, UntagResource, ListTagsForResource
**Observability stubs:** GetSampledRequests, GetTopPathStatisticsByTraffic, GetRateBasedStatementManagedKeys

Features: REGIONAL + CLOUDFRONT scope segmentation; ARN segment reflects scope (`regional/...` vs `global/...` with `us-east-1` region for CLOUDFRONT). Lock token rotates on every successful mutation. Managed rule catalog seeds three popular AWS-vendor rule groups (Common, KnownBadInputs, SQLi). Control plane only — fakecloud does not actually inspect any HTTP request.

Protocol: JSON 1.1 (`X-Amz-Target: AWSWAF_20190729.<Action>`)

### Athena (70 actions)

**Workgroups:** CreateWorkGroup, GetWorkGroup, ListWorkGroups, UpdateWorkGroup, DeleteWorkGroup
**Data Catalogs:** CreateDataCatalog, GetDataCatalog, ListDataCatalogs, UpdateDataCatalog, DeleteDataCatalog, GetDatabase, ListDatabases, GetTableMetadata, ListTableMetadata
**Named Queries:** Create/Get/List/Update/Delete + BatchGetNamedQuery
**Prepared Statements:** Create/Get/List/Update/Delete + BatchGetPreparedStatement (keyed by `(workgroup, statement_name)`)
**Query Executions:** StartQueryExecution, StopQueryExecution, GetQueryExecution, ListQueryExecutions, BatchGetQueryExecution, GetQueryResults, GetQueryRuntimeStatistics
**Notebooks:** CreateNotebook, ImportNotebook, ExportNotebook, GetNotebookMetadata, ListNotebookMetadata, UpdateNotebook, UpdateNotebookMetadata, DeleteNotebook, CreatePresignedNotebookUrl
**Sessions + Calculations:** StartSession, GetSession, GetSessionStatus, GetSessionEndpoint, ListSessions, ListNotebookSessions, TerminateSession, StartCalculationExecution, StopCalculationExecution, GetCalculationExecution, GetCalculationExecutionCode, GetCalculationExecutionStatus, ListCalculationExecutions
**Capacity Reservations:** Create/Get/List/Update/Cancel/Delete + Put/GetCapacityAssignmentConfiguration
**Tags + Read-only catalog:** TagResource, UntagResource, ListTagsForResource, ListEngineVersions, ListApplicationDPUSizes, ListExecutors, GetResourceDashboard

Features: `primary` workgroup + `AwsDataCatalog` GLUE catalog auto-seeded on first account touch and rejected on delete. `DeleteWorkGroup` refuses non-empty workgroups (queries / named queries / prepared statements) unless `RecursiveDeleteOption=true`. `StartQueryExecution` synthesizes a SUCCEEDED execution with a one-row `[["1"]]` result so callers can immediately fetch via `GetQueryResults` without polling. Statement classification (DML / DDL / UTILITY) inferred from leading SQL keyword. fakecloud is **not** a SQL engine — every query returns the synthesized result regardless of the SQL string.

Protocol: JSON 1.1 (`X-Amz-Target: AmazonAthena.<Action>`)

### EC2 (791 actions)

The complete EC2 control plane — the largest service surface in AWS, all at true 100% Smithy conformance.

**Networking:** VPCs (+ secondary CIDRs, tenancy), DHCP option sets, subnets (+ CIDR reservations), security groups (rules, references, VPC associations), route tables, internet / egress-only / NAT gateways, elastic IPs (+ transfer/move), network ACLs, VPC peering, VPC endpoints + PrivateLink, flow logs, prefix lists, ENIs (+ attachments, permissions, IPv4/IPv6 assignment).
**Compute & storage:** RunInstances + full lifecycle (start/stop/reboot/terminate/monitor), instance attributes/credit specs/metadata options, instance types + topology, key pairs, placement groups, EBS volumes (+ recycle bin), snapshots (+ copy/tier/lock/fast-restore/block-public-access), AMIs, EBS encryption defaults.
**Scaling & capacity:** launch templates (+ versions), spot requests / fleets / EC2 fleets, capacity reservations (+ fleets), reserved instances, dedicated hosts.
**Transit Gateway (74 ops):** gateways, attachments, route tables (+ associations/propagations/prefix-list refs), peering, Connect + Connect peers, policy tables, route-table announcements, multicast domains (+ group members/sources), metering policies, Client-VPN attachments.
**VPN:** Site-to-Site (customer gateways, VPGs, connections + routes/tunnels/device configs, concentrators) + full Client VPN (endpoints, routes, authorization rules, target networks, connections, cert/config export-import).
**IPAM:** IPAMs, scopes, pools, pool CIDRs + allocations, resource CIDRs, address history, resource discovery (+ associations + discovered getters), BYOASN, BYOIP-to-IPAM, external resource verification tokens, policies (+ allocation rules / org targets), prefix-list resolvers (+ targets / rules / versions).
**Edge & access:** Verified Access (instances, trust providers, groups, endpoints, policies, logging, client config), Network Insights (paths + analyses, access scopes + scope analyses), Outpost / local-gateway / CoIP (carrier gateways, CoIP pools, LGW route tables/routes/associations/virtual interfaces), EC2 Instance Connect, fast launch, serial-console access, console output / screenshot, password data.

Features: instances run as real containers — Docker/Podman by default, or native Kubernetes Pods with `FAKECLOUD_EC2_BACKEND=k8s` (or the global `FAKECLOUD_CONTAINER_BACKEND=k8s`), mirroring the Lambda/ECS/RDS/ElastiCache backends. `RunInstances` boots a container per instance (Amazon Linux by default, override via `FAKECLOUD_EC2_DEFAULT_IMAGE`), runs user-data at boot, and maps start/stop/reboot/terminate onto the container lifecycle; `GetConsoleOutput` returns the container's real log. When no container runtime is available the control plane degrades to a metadata-only instance so every call still succeeds. A few model ops absent from the vendored SDK (Describe/ModifyIpamPoolAllocation, capacity-reservation cancellation-quote pair) are validated via raw ec2Query. Real network isolation: every account+region ships a default VPC (172.31.0.0/16, IGW, per-AZ default subnets, default SG/NACL); each subnet gets its own Docker/Podman daemon network so same-subnet instances can talk while cross-VPC instances can't route to each other (private subnets use `--internal` networks). Security-group + NACL rules are enforced via host nftables (opt-in `FAKECLOUD_EC2_SG_ENFORCEMENT=1`, requires CAP_NET_ADMIN + nft) on Docker/Podman, or via per-instance NetworkPolicy objects (enforced by Calico/Cilium; created-but-not-enforced under kindnet) on Kubernetes; without the capability the rules are tracked-only and L3 isolation still holds. Introspection: `GET /_fakecloud/ec2/instances` lists instances with control-plane metadata plus the backing `containerId` (Docker container id / Pod name, or null when metadata-only); `GET /_fakecloud/ec2/instance-networks` reports each instance's backing network, container IP, isolation backend, and security-group enforcement mode (active vs degraded).

Protocol: ec2Query (form-encoded request, flattened-XML response)

### Organizations (63 actions)

Org tree (roots / OUs / accounts), `CreateAccount` real async `IN_PROGRESS -> SUCCEEDED` lifecycle, `LeaveOrganization`, policies (SCP / TAG / BACKUP / AISERVICES_OPT_OUT) with **real SCP enforcement** as a permission ceiling under `FAKECLOUD_IAM=strict`, handshakes (invite / accept / decline / cancel state machine), delegated administrators, AWS service access, effective-policy validation, billing responsibility transfers, resource policy, tagging. Mutating calls are management-account only.

Protocol: JSON 1.1

### Glue (265 actions)

Full Data Catalog (databases, tables, partitions with `GetPartitions` `Expression` pruning), jobs, crawlers, classifiers, connections, triggers, workflows, blueprints, dev endpoints, schema registry, interactive sessions, ML transforms, data quality, user-defined functions, usage profiles, column statistics, tagging. Real status transitions (crawler READY<->RUNNING, trigger/workflow/run lifecycles). Job/crawler/Spark execution itself is synthesized — fakecloud is not a Spark engine.

Protocol: JSON 1.1

### CloudWatch / Metrics & Alarms (46 actions)

Metrics (`PutMetricData` / `GetMetricData` / `GetMetricStatistics` / `ListMetrics` / `GetMetricWidgetImage`), metric + composite alarms with SNS / AppAS / EC2 actions on threshold transitions, dashboards, anomaly detectors, insight rules + managed rules + reports, metric streams, alarm mute rules, contributor insights, OTel enrichment, tagging. Metrics in-memory only; alarms evaluate against published data.

Protocol: awsQuery (SigV4 service `monitoring`, distinct from CloudWatch Logs)

### Firehose (12 actions)

Delivery streams with real S3 destination delivery (buffering hints honored), `ExtendedS3` / `Redshift` / `OpenSearch` / `Splunk` / `HttpEndpoint` / `Snowflake` / `Iceberg` destination round-trip, `BufferingHints` range checks, server-side encryption (`Start`/`StopDeliveryStreamEncryption`), `PutRecord` / `PutRecordBatch` with per-record IDs, tagging. Data plane stops at acknowledgement for non-S3 destinations.

Protocol: JSON 1.1

### Cognito Identity (23 actions)

Identity pools, federated identities, `GetId` / `GetCredentialsForIdentity` / `GetOpenIdToken` / `GetOpenIdTokenForDeveloperIdentity`, developer-authenticated identities, identity pool roles + role mappings, principal tags, tagging.

Protocol: JSON 1.1

### Bedrock Agent (72 actions) + Bedrock Agent Runtime (31 actions)

Agents, agent versions / aliases, action groups, knowledge bases, data sources, flows + flow aliases / versions, prompts, agent collaborators, tagging (control plane). Runtime: `InvokeAgent`, `InvokeFlow`, `Retrieve`, `RetrieveAndGenerate`, session + memory management, with configurable and streaming responses.

Protocol: REST-JSON

## Cross-Service Integration

fakecloud implements real cross-service message delivery:

- **SNS -> SQS/Lambda/HTTP**: Fan-out delivery to all subscription types
- **S3 -> SNS/SQS/Lambda/EventBridge**: Bucket notifications on object create/delete
- **EventBridge -> SNS/SQS/Lambda/Logs/Kinesis/HTTP**: Rules deliver to targets on schedule or event match, including API Destinations
- **SQS -> Lambda**: Event source mapping polls and invokes
- **Kinesis -> Lambda**: Event source mapping polls shards and invokes
- **DynamoDB Streams -> Lambda**: Event source mapping polls stream records and invokes
- **DynamoDB -> Kinesis**: Table changes stream to Kinesis Data Streams
- **CloudWatch Logs -> Lambda/Kinesis/SQS**: Subscription filters deliver log events
- **Cognito -> Lambda**: Pre-signup, post-confirmation, pre/post-auth, custom message, token generation, migration, and custom auth challenge triggers
- **SES -> SNS/EventBridge**: Email event fanout (send, delivery, bounce, complaint) via configured event destinations
- **SES Inbound -> S3/SNS/Lambda**: Receipt rules evaluate inbound email and execute S3, SNS, and Lambda actions
- **Step Functions -> Lambda/SQS/SNS/EventBridge/DynamoDB**: Task states invoke Lambda, send SQS messages, publish to SNS topics, put EventBridge events, and read/write DynamoDB items
- **API Gateway v1 -> Lambda**: REST API methods with `AWS_PROXY` integrations invoke Lambda functions with proxy event v1.0 format
- **API Gateway v2 -> Lambda**: HTTP API routes invoke Lambda functions with proxy integration v2.0 format
- **CloudFormation -> Lambda/SNS**: Custom resources invoke via ServiceToken, stack events notify via NotificationARNs
- **SecretsManager -> Lambda**: Rotation invokes Lambda for all 4 steps
- **S3 Lifecycle**: Background expiration and storage class transitions
- **EventBridge Scheduler**: Cron and rate-based rules fire on schedule

## Protocol Notes

fakecloud handles three AWS protocol families:

- **Query protocol** (SQS, SNS, IAM, STS, CloudFormation, SES v1, RDS, ElastiCache, EC2 ec2Query): form-encoded body with `Action` parameter, XML responses
- **JSON protocol** (SSM, EventBridge, DynamoDB, Secrets Manager, CloudWatch Logs, KMS, Cognito User Pools, Kinesis, Step Functions): JSON body, `X-Amz-Target` header, JSON responses
- **REST protocol** (S3, Lambda, SES v2, API Gateway v1, API Gateway v2, Bedrock, Bedrock Runtime, RDS Data API, Aurora DSQL, Resource Groups): HTTP method + path-based routing, XML or JSON responses

SigV4 signatures are parsed for service routing but never validated. Use any dummy credentials.

## Using with AI Coding Tools

Add these snippets to your project to make AI coding assistants automatically use fakecloud for AWS integration tests.

### Claude Code (CLAUDE.md)
```markdown
## AWS Testing
For integration tests, use fakecloud as a local AWS emulator.
- Install: `curl -fsSL https://fakecloud.dev/install.sh | bash`
- Run: `fakecloud` (listens on http://localhost:4566)
- Configure AWS SDK endpoint to http://localhost:4566 with dummy credentials (access_key=test, secret_key=test)
- Docs: https://fakecloud.dev/llms.txt
```

### Cursor (.cursor/rules)
```
For AWS integration tests, use fakecloud (local AWS emulator) at http://localhost:4566.
Install: curl -fsSL https://fakecloud.dev/install.sh | bash
Run: fakecloud
Use dummy credentials (access_key=test, secret_key=test).
Docs: https://fakecloud.dev/llms.txt
```

### GitHub Copilot (.github/copilot-instructions.md)
```markdown
## AWS Testing
Use fakecloud as a local AWS emulator for integration tests.
- Run: `fakecloud` (listens on http://localhost:4566)
- Configure endpoint_url to http://localhost:4566 with dummy credentials
- Docs: https://fakecloud.dev/llms.txt
```

## License

AGPL-3.0-or-later. Free and open-source, including for commercial use.

## Links

- Website: https://fakecloud.dev
- GitHub: https://github.com/faiscadev/fakecloud
- crates.io: https://crates.io/crates/fakecloud
- Part of the faisca project family: https://faisca.dev