LOCALAWS DOCUMENTATIONGUIDE

Overview

localaws is an AWS-compatible cloud for your home lab. Use the AWS CLI, SDKs, and Terraform against one local HTTP endpoint. Docker runs container workloads; LXD runs EC2 instances.

Start here

Quick start: launch the server and create your first bucket.
Installation: install a release or build from source.
Usage: configure credentials, discover resources, and clean up.
Choose a service under Usage for its prerequisites and commands.

Two addresses, two jobs

The AWS API listens at http://localhost:4566 by default. The optional StackPort browser console listens at http://localhost:8080 when started with --ui. Replace localhost with your server address when connecting from another machine.

Every signed request selects its service and region through the SigV4 credential scope. Use a region enabled in config.json; these examples use us-east-1.

Local behavior

localaws implements a subset of AWS APIs. Some settings are metadata only, and some integrations need host services. Each resource guide calls out prerequisites. S3, IAM, messaging, logs, and several other catalogs persist locally; other service metadata remains in memory. Restarting can leave running containers without their old metadata.

The repository README, service guides, and AWS_SERVICE_CAPABILITIES.json describe the detailed compatibility limits. Do not assume full AWS parity.

For automation and agents

Start with the documentation index to discover an individual Markdown page for every guide. Download all guides in one request, or use the existing complete Markdown reference. These contain the same guides and commands as this site, without requiring JavaScript. Download the example configuration and read the operation inventory for local capabilities.

Use explicit endpoints and regions in automation, read returned IDs instead of inventing them, and inspect resources before deleting them. Examples use demo names and assume a fresh installation.

Quick start

Install the Linux x86_64 release from an empty directory. It requires glibc 2.36+, curl, tar, and sha256sum. Have the AWS CLI installed for the resource commands below.

curl -fsSL https://my-stack-prod-production.up.railway.app/install.sh | sh
cd localaws
export LOCALAWS_CONFIG=$PWD/config.json
./localaws > localaws.log 2>&1 &

Wait for the server to listen on port 4566; check localaws.log if it exits. Keep the same working directory and config for subsequent start and stop commands.

Create, inspect, and delete a bucket

The example configuration has IAM enforcement off, so the test credentials below work for this S3 example. Use your authorized credentials when enforcement is enabled.

export LOCALAWS_ENDPOINT=http://localhost:4566
export AWS_ACCESS_KEY_ID=test AWS_SECRET_ACCESS_KEY=test
export AWS_DEFAULT_REGION=us-east-1 AWS_REGION=us-east-1
export AWS_PAGER=""
unset AWS_SESSION_TOKEN AWS_PROFILE AWS_DEFAULT_PROFILE
aws --endpoint-url "$LOCALAWS_ENDPOINT" s3api list-buckets
aws --endpoint-url "$LOCALAWS_ENDPOINT" s3api create-bucket --bucket hello-localaws
aws --endpoint-url "$LOCALAWS_ENDPOINT" s3api list-buckets
aws --endpoint-url "$LOCALAWS_ENDPOINT" s3api delete-bucket --bucket hello-localaws

The last command deletes the empty demo bucket. Choose a new bucket name if it already exists. For stored IAM keys required by STS, KMS, and some other APIs, follow Usage.

Add the browser console

Python 3.10+ with venv and pip is required. From the installed localaws directory:

python3 scripts/setup_ui.py
./localaws --stop
./localaws --ui > localaws.log 2>&1 &

Open http://localhost:8080. The console offers Dashboard, Resources, and guided Learn lessons. Its Documentation link returns here. Node.js is only needed to change the frontend.

Stop the server

LOCALAWS_CONFIG=$PWD/config.json ./localaws --stop

This also stops the companion console. See Installation for host prerequisites and source builds.

Installation

Host prerequisites

Linux x86_64 with glibc 2.36+ for the published binary.
curl, tar, and sha256sum for the installer.
AWS CLI for the examples; newer S3 families need CLI versions that include their service models.
Docker for ECS tasks, RDS databases, Lambda runtimes, and the ECR registry.
LXD with the lxc client for EC2 instances; ssh-keygen for key pairs.
OpenSSL for ACM certificate operations.
Python 3.10+ with venv and pip for the optional browser console.

Published release

Run one installer command from an empty directory:

curl -fsSL https://my-stack-prod-production.up.railway.app/install.sh | sh

Or include the browser console's Python dependencies:

curl -fsSL https://my-stack-prod-production.up.railway.app/install.sh | sh -s -- -ui

The installer verifies the archive checksum, extracts ./localaws, and creates config.json. It refuses to overwrite an existing localaws path. It does not start a server or install Docker or LXD. Both -ui and --ui are accepted by the installer.

Keep stackport/ and scripts/ next to the installed binary. From the installed directory, choose a launch mode:

cd localaws
export LOCALAWS_CONFIG=$PWD/config.json
./localaws --ui > localaws.log 2>&1 &

Use ./localaws without --ui for the API alone. Stop an existing instance before switching modes.

Update the executable

./localaws --update

Updates to the latest published Linux x86_64 binary, using the same archive and SHA-256 verification as the installer. An identical binary reports that it is already up to date. The command needs tar and write access to the executable's directory; it does not require LOCALAWS_CONFIG. Download or verification failures leave the existing executable intact. Restart a running server to use the update.

Configuration, data, and bundled browser-console files are preserved. To update the console as well, install a fresh bundle in another directory and retain your configuration and data. Set LOCALAWS_DOWNLOAD_BASE_URL to use a custom download origin. Updates require HTTPS, except for HTTP on loopback hosts (localhost, 127.0.0.1, or ::1); redirects follow the same rule. Updates follow the latest published build by binary contents; the current publication does not provide semantic version ordering.

Build from source

From a source checkout, install Rust 1.92 and copy the example configuration:

rustup toolchain install 1.92
cp config.example.json config.json
export LOCALAWS_CONFIG=$PWD/config.json
make start
# Stop the background server:
make stop

For the console in a source checkout:

python3 scripts/setup_ui.py
make start ARGS=--ui

The frontend build is committed, so normal use needs no Node.js installation.

Configuration

Set LOCALAWS_CONFIG to an absolute config path. The example binds the AWS API to 0.0.0.0:4566, stores local state under ./data, and enables several regions. Relative data paths resolve from the server's working directory.

The iam.enforcement setting controls authorization: off, record, iam-only, or all. Stored IAM credentials still undergo signature validation when enforcement is off. Configure credentials before enabling enforcement.

StackPort listens on all network interfaces and has no login. Use it on a trusted network. Set STACKPORT_PORT=9090 to change its port, or STACKPORT_ALLOW_WRITES=false to block console changes. Lambda invocation remains available and can have side effects. When credentials are omitted, the localaws launcher provisions console credentials; supply both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY to use your own.

Download config.example.json for the complete starting configuration. Optional providers, such as S3 Files NFS and Outposts, require additional configuration described in the repository's service guides.

Usage

Select a service in the left navigation for a creation example, prerequisites, and discovery commands. The examples use Bash and demo names on a fresh localaws installation.

Connect the AWS CLI

For an unmodified example configuration with IAM enforcement off:

export LOCALAWS_ENDPOINT=http://localhost:4566
export AWS_ACCESS_KEY_ID=test AWS_SECRET_ACCESS_KEY=test
export AWS_DEFAULT_REGION=us-east-1 AWS_REGION=us-east-1
export AWS_PAGER=""
unset AWS_SESSION_TOKEN AWS_PROFILE AWS_DEFAULT_PROFILE

Replace localhost for a remote server and select a configured region. Always include --endpoint-url "$LOCALAWS_ENDPOINT"; this directs the command to your local server.

Create stored credentials

STS and KMS require stored keys even when enforcement is off. With the fresh example configuration, create a demo administrator, then use its returned credentials:

aws --endpoint-url "$LOCALAWS_ENDPOINT" iam create-user --user-name demo-cli-user
aws --endpoint-url "$LOCALAWS_ENDPOINT" iam put-user-policy \
  --user-name demo-cli-user --policy-name demo-local-admin \
  --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"*","Resource":"*"}]}'
read -r AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY <<< "$(aws --endpoint-url "$LOCALAWS_ENDPOINT" iam create-access-key \
  --user-name demo-cli-user --query 'AccessKey.[AccessKeyId,SecretAccessKey]' --output text)"
export AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
aws --endpoint-url "$LOCALAWS_ENDPOINT" sts get-caller-identity

This grants broad local permissions. If IAM enforcement is already enabled, use existing authorized credentials and skip this bootstrap. Keep returned secrets private. Repeatable scripts should reuse an existing demo user or choose unique names.

Discover and inspect resources

aws --endpoint-url "$LOCALAWS_ENDPOINT" s3api list-buckets
aws --endpoint-url "$LOCALAWS_ENDPOINT" dynamodb list-tables
aws --endpoint-url "$LOCALAWS_ENDPOINT" ec2 describe-instances

The localaws binary accepts server startup, --ui, and --stop; it has no native resource-list or delete subcommands. Use service-specific AWS CLI or SDK calls for headless management.

In the browser console, Dashboard shows service counts and Resources provides service views. Some localaws APIs have no console view; their CLI commands still work. Learn lessons create real local resources.

SDKs and scripts

Use the same endpoint, credentials, and region with SDK clients. This Python example requires boto3 installed in your environment:

import os
import boto3

s3 = boto3.client(
    "s3",
    endpoint_url=os.environ["LOCALAWS_ENDPOINT"],
    region_name=os.environ.get("AWS_DEFAULT_REGION", "us-east-1"),
)
print([bucket["Name"] for bucket in s3.list_buckets()["Buckets"]])

For Terraform, point every used service endpoint at localaws. The repository's terraform directory contains complete examples and acceptance fixtures.

Delete deliberately

Use the IDs, URLs, and ARNs returned by create/list operations. Inspect the selected resource first. Empty S3 buckets before deletion; versioned buckets also require deleting versions and delete markers. Remove dependent resources before their parent. Terminating instances and deleting databases can discard workload data.

# These remove the empty resources with these exact demo names:
aws --endpoint-url "$LOCALAWS_ENDPOINT" s3api delete-bucket --bucket demo-bucket
aws --endpoint-url "$LOCALAWS_ENDPOINT" dynamodb delete-table --table-name demo-items

Stopping localaws is separate from resource deletion. Persistent catalogs survive restarts, and workload containers can outlive memory-only metadata. Back up data directories together with their encryption keys.

Troubleshooting

Connection refused: check localaws.log, the configured listener, and whether the server is running.
InvalidRegion: choose a region in config.json.
Access denied or signature errors: verify credentials, session token, region, and IAM enforcement mode.
Unsupported operation: check the operation inventory and the service guide; localaws implements a subset of AWS.
Container or instance failures: check Docker or LXD access on the server host.
Console unavailable: run scripts/setup_ui.py, check STACKPORT_PORT, and restart with --ui.

S3

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Create a general-purpose bucket in us-east-1.

aws --endpoint-url "$LOCALAWS_ENDPOINT" s3api create-bucket --bucket demo-bucket

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" s3api list-buckets

Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the operation inventory for supported actions and the usage guide for cleanup and troubleshooting.

DynamoDB

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Create a table with a string partition key and on-demand billing.

aws --endpoint-url "$LOCALAWS_ENDPOINT" dynamodb create-table \
  --table-name demo-items \
  --attribute-definitions AttributeName=id,AttributeType=S \
  --key-schema AttributeName=id,KeyType=HASH \
  --billing-mode PAY_PER_REQUEST

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" dynamodb list-tables

Local compatibility

Kinesis

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Local Kinesis supports one shard per stream.

aws --endpoint-url "$LOCALAWS_ENDPOINT" kinesis create-stream \
  --stream-name demo-stream --shard-count 1

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" kinesis list-streams

Local compatibility

Lambda

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Requires Docker and Python 3. Creates its own execution role and ZIP package; Python 3.12 is in the example configuration.

LAMBDA_ROLE=$(aws --endpoint-url "$LOCALAWS_ENDPOINT" iam create-role \
  --role-name demo-lambda-role \
  --assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"lambda.amazonaws.com"},"Action":"sts:AssumeRole"}]}' \
  --query Role.Arn --output text)
python3 - <<'PYTHON'
import zipfile
with zipfile.ZipFile("demo-function.zip", "w") as archive:
    archive.writestr("handler.py", 'def handler(event, context):\n    return {"message": "Hello from localaws"}\n')
PYTHON
aws --endpoint-url "$LOCALAWS_ENDPOINT" lambda create-function \
  --function-name demo-function --runtime python3.12 --handler handler.handler \
  --role "$LAMBDA_ROLE" --zip-file fileb://demo-function.zip

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" lambda list-functions

Local compatibility

ECS

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates an empty cluster. Running tasks in it requires Docker.

aws --endpoint-url "$LOCALAWS_ENDPOINT" ecs create-cluster --cluster-name demo-cluster

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" ecs list-clusters

Local compatibility

ECR

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Requires Docker; the local registry starts on first use.

aws --endpoint-url "$LOCALAWS_ENDPOINT" ecr create-repository --repository-name demo-app

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" ecr describe-repositories

Local compatibility

EC2

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Requires LXD. Uses the configured Ubuntu image and the default us-east-1 subnet; leave NO_DEFAULTS unset.

aws --endpoint-url "$LOCALAWS_ENDPOINT" ec2 run-instances \
  --image-id ami-ubuntu-2404 --instance-type t3.micro --count 1

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" ec2 describe-instances

Local compatibility

VPC networking (EC2)

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates a network record. Local VPCs do not change the host network.

aws --endpoint-url "$LOCALAWS_ENDPOINT" ec2 create-vpc --cidr-block 10.42.0.0/16

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" ec2 describe-vpcs

Local compatibility

EFS

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates local filesystem storage. Encryption and AWS Backup must remain disabled; no NFS endpoint is advertised.

aws --endpoint-url "$LOCALAWS_ENDPOINT" efs create-file-system \
  --creation-token demo-efs --no-encrypted --no-backup \
  --tags Key=Name,Value=demo-files

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" efs describe-file-systems

Local compatibility

RDS

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Requires Docker. The password is for this local example; choose your own before using the database.

aws --endpoint-url "$LOCALAWS_ENDPOINT" rds create-db-instance \
  --db-instance-identifier demo-db --engine postgres --db-instance-class db.t3.micro \
  --allocated-storage 20 --master-username demo --master-user-password 'LocalDemoPass123!'

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" rds describe-db-instances

Local compatibility

IAM

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates an IAM user. Access keys are created separately with iam create-access-key.

aws --endpoint-url "$LOCALAWS_ENDPOINT" iam create-user --user-name demo-user

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" iam list-users

Local compatibility

STS

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

STS has no create-resource API. This supported call shows the account and identity used for requests.

aws --endpoint-url "$LOCALAWS_ENDPOINT" sts get-caller-identity

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" sts get-caller-identity

Local compatibility

KMS

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates a local symmetric encryption key.

aws --endpoint-url "$LOCALAWS_ENDPOINT" kms create-key

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" kms list-keys

Local compatibility

Secrets Manager

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Stores a local example secret.

aws --endpoint-url "$LOCALAWS_ENDPOINT" secretsmanager create-secret \
  --name demo/credentials --secret-string '{"username":"demo","password":"local-example"}'

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" secretsmanager list-secrets

Local compatibility

SSM Parameter Store

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

PutParameter creates a named parameter.

aws --endpoint-url "$LOCALAWS_ENDPOINT" ssm put-parameter \
  --name /demo/greeting --type String --value 'Hello from localaws'

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" ssm describe-parameters

Local compatibility

SQS

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates a standard queue.

aws --endpoint-url "$LOCALAWS_ENDPOINT" sqs create-queue --queue-name demo-queue

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" sqs list-queues

Local compatibility

SNS

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates a standard notification topic.

aws --endpoint-url "$LOCALAWS_ENDPOINT" sns create-topic --name demo-topic

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" sns list-topics

Local compatibility

SES

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates a local identity with the SES v2 API. Verification is a separate step; local mail is captured rather than sent externally.

aws --endpoint-url "$LOCALAWS_ENDPOINT" sesv2 create-email-identity \
  --email-identity demo@example.com

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" sesv2 list-email-identities

Local compatibility

ACM

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Requests a certificate from the local CA. Add the returned DNS validation records to local Route 53 to complete issuance.

aws --endpoint-url "$LOCALAWS_ENDPOINT" acm request-certificate \
  --domain-name demo.example.com --validation-method DNS

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" acm list-certificates

Local compatibility

API Gateway

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates an empty REST API; add resources, methods and a deployment before invoking it.

aws --endpoint-url "$LOCALAWS_ENDPOINT" apigateway create-rest-api --name demo-api

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" apigateway get-rest-apis

Local compatibility

Route 53

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates a local hosted zone.

aws --endpoint-url "$LOCALAWS_ENDPOINT" route53 create-hosted-zone \
  --name demo.example.com --caller-reference "demo-$(date +%s)"

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" route53 list-hosted-zones

Local compatibility

Route 53 Domains

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates a local registry entry and hosted zone. This does not register a domain on the public internet.

CONTACT='{"FirstName":"Demo","LastName":"User","ContactType":"PERSON","AddressLine1":"123 Example St","City":"Seattle","State":"WA","CountryCode":"US","ZipCode":"98101","PhoneNumber":"+1.2065550100","Email":"demo@example.com"}'
aws --endpoint-url "$LOCALAWS_ENDPOINT" route53domains register-domain \
  --domain-name localaws-demo.com --duration-in-years 1 \
  --admin-contact "$CONTACT" --registrant-contact "$CONTACT" --tech-contact "$CONTACT"

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" route53domains list-domains

Local compatibility

ELBv2 / ALB

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates its own VPC and two subnets in different availability zones. Add a target group and listener to route requests.

VPC_ID=$(aws --endpoint-url "$LOCALAWS_ENDPOINT" ec2 create-vpc \
  --cidr-block 10.43.0.0/16 --query Vpc.VpcId --output text)
SUBNET_A=$(aws --endpoint-url "$LOCALAWS_ENDPOINT" ec2 create-subnet \
  --vpc-id "$VPC_ID" --cidr-block 10.43.1.0/24 --availability-zone us-east-1a \
  --query Subnet.SubnetId --output text)
SUBNET_B=$(aws --endpoint-url "$LOCALAWS_ENDPOINT" ec2 create-subnet \
  --vpc-id "$VPC_ID" --cidr-block 10.43.2.0/24 --availability-zone us-east-1b \
  --query Subnet.SubnetId --output text)
aws --endpoint-url "$LOCALAWS_ENDPOINT" elbv2 create-load-balancer \
  --name demo-alb --type application --scheme internet-facing \
  --subnets "$SUBNET_A" "$SUBNET_B"

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" elbv2 describe-load-balancers

Local compatibility

EventBridge

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates a custom event bus. Add rules and targets to deliver events.

aws --endpoint-url "$LOCALAWS_ENDPOINT" events create-event-bus --name demo-bus

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" events list-event-buses

Local compatibility

Step Functions

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates its own service role and a minimal Pass workflow.

STATES_ROLE=$(aws --endpoint-url "$LOCALAWS_ENDPOINT" iam create-role \
  --role-name demo-states-role \
  --assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"states.amazonaws.com"},"Action":"sts:AssumeRole"}]}' \
  --query Role.Arn --output text)
aws --endpoint-url "$LOCALAWS_ENDPOINT" stepfunctions create-state-machine \
  --name demo-workflow --role-arn "$STATES_ROLE" \
  --definition '{"StartAt":"Hello","States":{"Hello":{"Type":"Pass","Result":"Hello from localaws","End":true}}}'

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" stepfunctions list-state-machines

Local compatibility

CloudWatch Logs

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates a group and a stream ready for log events.

aws --endpoint-url "$LOCALAWS_ENDPOINT" logs create-log-group --log-group-name /demo/app
aws --endpoint-url "$LOCALAWS_ENDPOINT" logs create-log-stream \
  --log-group-name /demo/app --log-stream-name demo-stream

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" logs describe-log-groups

Local compatibility

CloudTrail

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Local management history is recorded automatically with the example configuration. Trail creation is unsupported; look up the events from your other commands.

aws --endpoint-url "$LOCALAWS_ENDPOINT" cloudtrail lookup-events --max-results 10

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" cloudtrail lookup-events --max-results 10

Local compatibility

S3 Control

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates its own bucket. S3 Control adds the account to the request hostname; the proxy settings below route that hostname to localaws without extra DNS setup.

aws --endpoint-url "$LOCALAWS_ENDPOINT" s3api create-bucket --bucket demo-access-bucket
ACCOUNT_ID=$(aws --endpoint-url "$LOCALAWS_ENDPOINT" sts get-caller-identity \
  --query Account --output text)
HTTP_PROXY="$LOCALAWS_ENDPOINT" http_proxy="$LOCALAWS_ENDPOINT" NO_PROXY= no_proxy= \
  aws --endpoint-url "$LOCALAWS_ENDPOINT" s3control create-access-point \
  --account-id "$ACCOUNT_ID" --name demo-access --bucket demo-access-bucket

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

HTTP_PROXY="$LOCALAWS_ENDPOINT" http_proxy="$LOCALAWS_ENDPOINT" NO_PROXY= no_proxy= \
  aws --endpoint-url "$LOCALAWS_ENDPOINT" s3control list-access-points --account-id "$ACCOUNT_ID"

Local compatibility

S3 Tables

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Requires an AWS CLI version with the s3tables service model.

aws --endpoint-url "$LOCALAWS_ENDPOINT" s3tables create-table-bucket --name demo-tables

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" s3tables list-table-buckets

Local compatibility

S3 Vectors

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Requires an AWS CLI version with the s3vectors service model. Vector search is local and exact.

aws --endpoint-url "$LOCALAWS_ENDPOINT" s3vectors create-vector-bucket \
  --vector-bucket-name demo-vectors

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" s3vectors list-vector-buckets

Local compatibility

S3 Files

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

First configure s3.files_nfs on the server and use an AWS CLI with the s3files service model. This example creates a versioned bucket and a service role with access to that bucket. Without the NFS provider, creation returns an unsupported error.

aws --endpoint-url "$LOCALAWS_ENDPOINT" s3api create-bucket --bucket demo-files-bucket
aws --endpoint-url "$LOCALAWS_ENDPOINT" s3api put-bucket-versioning \
  --bucket demo-files-bucket --versioning-configuration Status=Enabled
FILES_ROLE=$(aws --endpoint-url "$LOCALAWS_ENDPOINT" iam create-role \
  --role-name demo-files-role \
  --assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"s3files.amazonaws.com"},"Action":"sts:AssumeRole"}]}' \
  --query Role.Arn --output text)
aws --endpoint-url "$LOCALAWS_ENDPOINT" iam put-role-policy \
  --role-name demo-files-role --policy-name demo-files-access \
  --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":["arn:aws:s3:::demo-files-bucket","arn:aws:s3:::demo-files-bucket/*"]}]}'
aws --endpoint-url "$LOCALAWS_ENDPOINT" s3files create-file-system \
  --bucket arn:aws:s3:::demo-files-bucket --role-arn "$FILES_ROLE"

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" s3files list-file-systems

Local compatibility

S3 on Outposts

Complete the CLI and credentials setup before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

First configure an Outpost under s3.regional.outposts. Set OUTPOST_ID, OUTPOST_SUBNET_ID and OUTPOST_SECURITY_GROUP_ID to that configured record’s IDs. Use the stored credentials from the setup above; Outposts requests require verified credentials and permission for s3-outposts:CreateEndpoint.

aws --endpoint-url "$LOCALAWS_ENDPOINT" s3outposts create-endpoint \
  --outpost-id "${OUTPOST_ID:?Set the configured Outpost ID}" \
  --subnet-id "${OUTPOST_SUBNET_ID:?Set the configured subnet ID}" \
  --security-group-id "${OUTPOST_SECURITY_GROUP_ID:?Set the configured security group ID}" \
  --access-type Private

Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

aws --endpoint-url "$LOCALAWS_ENDPOINT" s3outposts list-endpoints