{ "schema_version": 1, "scope": "Supported local services and observability. Local behavior, not an AWS parity declaration.", "storage": { "format": 1, "catalogs": "/catalogs//.json", "protection": "AES-256-GCM snapshots with namespace-bound authenticated encryption", "key": "/catalogs//master.key (owner-only local key, not AWS KMS)", "limits": ["256 MiB per snapshot", "Single process owns a data directory", "No automatic key rotation or cross-process locking", "Legacy service catalogs remain memory-only"] }, "services": { "sts": { "protocols": [ "AWS Query XML 2011-06-15" ], "recognized_operations": [ "AssumeRole", "GetCallerIdentity" ], "behavior": [ "Always verifies caller credentials and role trust, independent of the enforcement mode", "Encrypted durable ASIA keys and opaque tokens; token/signature/expiry/role-identity verification", "Identity permission for account trust, direct same-account principal grants and explicit deny precedence", "Inline and up to ten same-account managed session policies constrain role policies and boundaries", "900 second minimum, role maximum duration and one-hour role chaining", "AssumeRole decisions are recorded as sts:AssumeRole authorization targets" ], "unsupported_features": [ "MFA assumptions, session tags, source identity and trusted contexts", "Web identity/SAML federation and other token APIs", "Cross-account assumptions and full AWS condition context" ] }, "iam": { "protocols": [ "AWS Query XML 2010-05-08" ], "recognized_operations": [ "AcceptDelegationRequest", "AcquireRole", "AddClientIDToOpenIDConnectProvider", "AddRoleToInstanceProfile", "AddUserToGroup", "AssociateDelegationRequest", "AttachGroupPolicy", "AttachRolePolicy", "AttachUserPolicy", "ChangePassword", "CreateAccessKey", "CreateAccountAlias", "CreateDelegationRequest", "CreateGroup", "CreateInstanceProfile", "CreateLoginProfile", "CreateOpenIDConnectProvider", "CreatePolicy", "CreatePolicyVersion", "CreateRole", "CreateSAMLProvider", "CreateServiceLinkedRole", "CreateServiceSpecificCredential", "CreateUser", "CreateVirtualMFADevice", "DeactivateMFADevice", "DeleteAccessKey", "DeleteAccountAlias", "DeleteAccountPasswordPolicy", "DeleteGroup", "DeleteGroupPolicy", "DeleteInstanceProfile", "DeleteLoginProfile", "DeleteOpenIDConnectProvider", "DeletePolicy", "DeletePolicyVersion", "DeleteRole", "DeleteRolePermissionsBoundary", "DeleteRolePolicy", "DeleteSAMLProvider", "DeleteSSHPublicKey", "DeleteServerCertificate", "DeleteServiceLinkedRole", "DeleteServiceSpecificCredential", "DeleteSigningCertificate", "DeleteUser", "DeleteUserPermissionsBoundary", "DeleteUserPolicy", "DeleteVirtualMFADevice", "DetachGroupPolicy", "DetachRolePolicy", "DetachUserPolicy", "DisableOrganizationsRootCredentialsManagement", "DisableOrganizationsRootSessions", "DisableOutboundWebIdentityFederation", "EnableMFADevice", "EnableOrganizationsRootCredentialsManagement", "EnableOrganizationsRootSessions", "EnableOutboundWebIdentityFederation", "GenerateCredentialReport", "GenerateOrganizationsAccessReport", "GenerateServiceLastAccessedDetails", "GetAccessKeyLastUsed", "GetAccountAuthorizationDetails", "GetAccountPasswordPolicy", "GetAccountProperties", "GetAccountSummary", "GetContextKeysForCustomPolicy", "GetContextKeysForPrincipalPolicy", "GetCredentialReport", "GetDelegationRequest", "GetGroup", "GetGroupPolicy", "GetHumanReadableSummary", "GetInstanceProfile", "GetLoginProfile", "GetMFADevice", "GetOpenIDConnectProvider", "GetOrganizationsAccessReport", "GetOutboundWebIdentityFederationInfo", "GetPolicy", "GetPolicyVersion", "GetRole", "GetRolePolicy", "GetRoleTemplateVersion", "GetSAMLProvider", "GetSSHPublicKey", "GetServerCertificate", "GetServiceLastAccessedDetails", "GetServiceLastAccessedDetailsWithEntities", "GetServiceLinkedRoleDeletionStatus", "GetUser", "GetUserPolicy", "ListAccessKeys", "ListAccountAliases", "ListAttachedGroupPolicies", "ListAttachedRolePolicies", "ListAttachedUserPolicies", "ListDelegationRequests", "ListEntitiesForPolicy", "ListGroupPolicies", "ListGroups", "ListGroupsForUser", "ListInstanceProfileTags", "ListInstanceProfiles", "ListInstanceProfilesForRole", "ListMFADeviceTags", "ListMFADevices", "ListOpenIDConnectProviderTags", "ListOpenIDConnectProviders", "ListOrganizationsFeatures", "ListPolicies", "ListPoliciesGrantingServiceAccess", "ListPolicyTags", "ListPolicyVersions", "ListRolePolicies", "ListRoleTags", "ListRoles", "ListSAMLProviderTags", "ListSAMLProviders", "ListSSHPublicKeys", "ListServerCertificateTags", "ListServerCertificates", "ListServiceSpecificCredentials", "ListSigningCertificates", "ListUserPolicies", "ListUserTags", "ListUsers", "ListVirtualMFADevices", "PutAccountProperties", "PutGroupPolicy", "PutRolePermissionsBoundary", "PutRolePolicy", "PutUserPermissionsBoundary", "PutUserPolicy", "RejectDelegationRequest", "RemoveClientIDFromOpenIDConnectProvider", "RemoveRoleFromInstanceProfile", "RemoveUserFromGroup", "ResetServiceSpecificCredential", "ResyncMFADevice", "SendDelegationToken", "SetDefaultPolicyVersion", "SetSecurityTokenServicePreferences", "SimulateCustomPolicy", "SimulatePrincipalPolicy", "TagInstanceProfile", "TagMFADevice", "TagOpenIDConnectProvider", "TagPolicy", "TagRole", "TagSAMLProvider", "TagServerCertificate", "TagUser", "UntagInstanceProfile", "UntagMFADevice", "UntagOpenIDConnectProvider", "UntagPolicy", "UntagRole", "UntagSAMLProvider", "UntagServerCertificate", "UntagUser", "UpdateAccessKey", "UpdateAccountPasswordPolicy", "UpdateAssumeRolePolicy", "UpdateDelegationRequest", "UpdateGroup", "UpdateLoginProfile", "UpdateOpenIDConnectProviderThumbprint", "UpdateRole", "UpdateRoleDescription", "UpdateSAMLProvider", "UpdateSSHPublicKey", "UpdateServerCertificate", "UpdateServiceSpecificCredential", "UpdateSigningCertificate", "UpdateUser", "UploadSSHPublicKey", "UploadServerCertificate", "UploadSigningCertificate" ], "behavior": [ "Atomic durable account catalog with encrypted credential secrets and hashed passwords", "Users, groups, roles, managed policy versions and boundaries, inline policies, tags and scoped pagination", "Instance profiles validated and reported by EC2 RunInstances/DescribeInstances", "Two-code TOTP validation and replay prevention; parsed and cryptographically validated server certificates", "SAML metadata and OIDC provider records; policy simulation with explicit deny, conditions and boundaries", "Stored-key SigV4 verification, last-used attribution, asynchronous credential and service-access reports", "Durable local delegation records and SNS notification outbox; explicit standalone Organizations errors", "STS assumed-role activity attribution and role/session-policy intersection in enforced API mappings", "Workload sessions for Lambda execution roles and ECS task roles, with sessionContext and workload attribution in audit records" ], "options": { "iam.enforcement": "Required off|record|iam-only|all; off still verifies recognized keys; record evaluates and records every verified call without blocking; all enforces the IAM, S3, RDS, CloudTrail, Logs and workload-service action maps and denies unmapped services including root", "iam.workloads": "Required; credentials off, or on with endpoint_url and ecs_relay_image: Lambda functions and ECS tasks sign with their roles (docs/WORKLOAD_IDENTITY.md)", "POST /_localaws/iam/policy-generation": "Root-only least-privilege policy from a role's recorded authorization targets, with unmapped calls, coverage gaps and size warnings", "RootCredentials": "Explicit LOCALAWS_IAM_ROOT_ACCESS_KEY_ID plus LOCALAWS_IAM_ROOT_SECRET_ACCESS_KEY; verified root bypasses user policies", "GetMFADevice": "FIDO-specific AWS API: virtual TOTP device InvalidInput; unregistered devices NoSuchEntity", "OIDC omitted ThumbprintList": "InvalidInput; automatic TLS thumbprint discovery unavailable", "SAML assertion encryption/private keys": "InvalidInput; federation execution unavailable", "SendDelegationToken": "ServiceFailure until STS token execution exists", "GetHumanReadableSummary": "NOT_SUPPORTED", "Organizations": "OrganizationNotFound or AccessDenied for standalone-account feature/report calls" }, "unsupported_features": [ "Instance metadata credentials and STS federation/token APIs beyond AssumeRole/GetCallerIdentity", "SAML/OIDC sign-in and outbound token generation/discovery", "Organizations SCP/RCP enforcement and account integration", "FIDO registration and attestation", "Full cross-account/resource-policy authorization and IAM condition context", "Authorization of unmapped services, internal service calls, public invocations and database-protocol connections", "Service-linked deletion dependency discovery outside IAM catalog", "Automatic OIDC thumbprints and SAML assertion encryption" ] }, "ssm": { "protocols": ["AWS JSON 1.1 AmazonSSM"], "supported_operations": ["PutParameter", "GetParameter", "GetParameters", "GetParametersByPath", "GetParameterHistory", "DescribeParameters", "DeleteParameter", "DeleteParameters", "LabelParameterVersion", "UnlabelParameterVersion", "AddTagsToResource", "RemoveTagsFromResource", "ListTagsForResource", "GetServiceSetting", "UpdateServiceSetting", "ResetServiceSetting"], "behavior": ["Durable String/StringList/SecureString versions, labels, paths and tags", "SecureString ciphertext unless WithDecryption=true", "Advanced/Intelligent-Tiering with 8 KiB values", "Expiration policies delete expired parameters on catalog access", "Secrets Manager reference reads with stage/version selectors"], "options": { "KeyId": "Only alias/aws/ssm; uses local authenticated encryption", "Policies.Expiration": "Enforced locally", "Policies.ExpirationNotification/NoChangeNotification": "UnsupportedOperation", "DataType": "Only text; AMI validation unsupported", "AllowedPattern": "Rust regex syntax", "ServiceSetting": "Only parameter-store/default-parameter-tier" }, "unsupported_features": ["Custom KMS", "Parameter sharing", "SSM operations outside Parameter Store"] }, "secretsmanager": { "protocols": ["AWS JSON 1.1 secretsmanager"], "supported_operations": ["CreateSecret", "DescribeSecret", "ListSecrets", "UpdateSecret", "DeleteSecret", "RestoreSecret", "PutSecretValue", "GetSecretValue", "BatchGetSecretValue", "ListSecretVersionIds", "UpdateSecretVersionStage", "TagResource", "UntagResource", "GetRandomPassword", "PutResourcePolicy", "GetResourcePolicy", "DeleteResourcePolicy", "ValidateResourcePolicy", "ReplicateSecretToRegions", "RemoveRegionsFromReplication", "StopReplicationToReplica", "RotateSecret", "CancelRotateSecret"], "behavior": ["Encrypted durable catalogs, string/binary values, retry tokens, stage promotion", "Recovery-window deletion, partial ARN lookup, age-based unlabelled-version garbage collection", "Constrained passwords from operating-system randomness", "Synchronous local regional replication and replica promotion", "Manual Lambda rotation executes createSecret/setSecret/testSecret/finishSecret and verifies stages", "Same-account role and user resource-policy principals are evaluated by IAM in enforced and record modes"], "options": { "KmsKeyId": "Only default local protection; custom KMS unsupported", "ResourcePolicy": "Restricted read-policy grammar; explicit deny enforced, complex IAM conditions unsupported", "RotationRules/RotationToken/RotateImmediately=false": "UnsupportedOperation; no rotation scheduler", "Replication": "Local regional copies in the same account, not cross-account or geographically separate storage" }, "unsupported_features": ["AWS KMS", "Scheduled or managed database rotation", "Full IAM policy evaluation"] }, "logs": { "protocols": [ "AWS JSON 1.1 Logs_20140328" ], "supported_operations": [ "CreateLogGroup", "DeleteLogGroup", "UpdateLogGroup", "DescribeLogGroups", "CreateLogStream", "DeleteLogStream", "DescribeLogStreams", "PutLogEvents", "GetLogEvents", "FilterLogEvents", "PutRetentionPolicy", "DeleteRetentionPolicy", "TagLogGroup", "UntagLogGroup", "ListTagsLogGroup", "TagResource", "UntagResource", "ListTagsForResource", "StartQuery", "GetQueryResults", "StopQuery", "DescribeQueries", "GetLogGroupFields", "GetLogRecord", "PutResourcePolicy", "DeleteResourcePolicy", "DescribeResourcePolicies", "PutMetricFilter", "DescribeMetricFilters", "DeleteMetricFilter", "TestMetricFilter" ], "behavior": [ "Durable regional groups/streams/events, event-window rejection, retention, scoped directional pagination", "Term/JSON/regex filters", "Real bounded Insights evaluation: fields, filter, sort, limit, count with grouping", "Full Lambda invocation logs and incremental ECS awslogs capture", "Prospective metric filters across all ingestion paths, durable versioned metric contributions and default/late reconciliation" ], "options": { "sequenceToken": "Ignored using current PutLogEvents behavior", "logGroupClass": "STANDARD only", "ResourcePolicy": "Stored policy; restricted events.amazonaws.com PutLogEvents/SourceArn/SourceAccount authorization for EventBridge Logs targets", "queryLanguage": "Supported Insights subset only; unsupported commands reject", "ECS capture": "Polling on reconciliation and termination, not a continuous streaming daemon" }, "unsupported_features": [ "Subscriptions and live tail", "S3 exports", "KMS", "Data protection", "Full Insights query language" ], "observability": "Managed audit/events groups and optional EC2 guest groups; stable producer dedup and restricted EventBridge resource-policy enforcement" }, "sqs": { "protocols": ["AWS JSON 1.0 AmazonSQS", "Query/XML", "Queue URL routing"], "supported_operations": ["CreateQueue", "DeleteQueue", "ListQueues", "GetQueueUrl", "GetQueueAttributes", "SetQueueAttributes", "TagQueue", "UntagQueue", "ListQueueTags", "SendMessage", "SendMessageBatch", "ReceiveMessage", "DeleteMessage", "DeleteMessageBatch", "ChangeMessageVisibility", "ChangeMessageVisibilityBatch", "PurgeQueue", "ListDeadLetterSourceQueues", "StartMessageMoveTask", "CancelMessageMoveTask", "ListMessageMoveTasks"], "behavior": ["Durable standard/FIFO queues, messages, leases, delayed availability and retention", "Asynchronous long polling, stale receipt validation, actual body/attribute MD5", "Batch partial failures, DLQ redrive policies and bounded resumable move jobs", "FIFO per-group order/deduplication and receive-attempt replay", "Real Lambda mapping batching, filters, partial failures and visibility heartbeat", "EventBridge targets and Step Functions sendMessage integration"], "options": { "QueueUrl": "LOCALAWS_ENDPOINT_URL supplies reachable base URL", "Policy/AddPermission/RemovePermission": "Explicit unsupported response", "KmsMasterKeyId/SqsManagedSseEnabled=true": "Explicit unsupported response; catalogs still encrypted locally", "Lambda scaling": "One local poller per mapping; distributed AWS autoscaling unsupported", "Counts": "Computed locally; no distributed approximation" }, "unsupported_features": ["Queue IAM policy enforcement", "AWS KMS or SQS managed SSE", "AWS distributed throughput/scaling"] }, "sns": { "protocols": ["Query/XML"], "supported_operations": ["CreateTopic", "DeleteTopic", "ListTopics", "GetTopicAttributes", "SetTopicAttributes", "Subscribe", "ConfirmSubscription", "Unsubscribe", "ListSubscriptions", "ListSubscriptionsByTopic", "GetSubscriptionAttributes", "SetSubscriptionAttributes", "Publish", "PublishBatch", "TagResource", "UntagResource", "ListTagsForResource", "AddPermission", "RemovePermission"], "behavior": ["Durable topics/subscriptions, confirmation tokens and leased delivery outbox", "Real SQS raw/envelope, Lambda and explicitly unsigned HTTP(S) notifications", "Attribute/body nested filters, FIFO deduplication and ordering", "Retry/backoff, subscription DLQs, restart recovery and delivery history", "SES event fan-out, EventBridge targets and Step Functions publish integration"], "options": { "LocalUnsignedDelivery=true": "Required explicit opt-in for HTTP(S); default signed delivery unsupported", "HTTP(S)": "5-second timeout, redirects disabled", "Policy/AddPermission/RemovePermission": "Validated and stored metadata, not full IAM enforcement", "KmsMasterKeyId/SignatureVersion": "NotImplemented", "EventBridge FIFO": "Unsupported; direct Publish supports FIFO attributes" }, "unsupported_features": ["Signed HTTP envelopes", "Email/SMS/mobile providers", "Archive/replay", "AWS KMS", "Full IAM enforcement"] }, "ses": { "protocols": ["SES v1 Query/XML", "SES v2 REST JSON /v2/email", "Optional local SMTP capture"], "supported_operations": ["VerifyEmailIdentity", "VerifyEmailAddress", "VerifyDomainIdentity", "VerifyDomainDkim", "CreateEmailIdentity", "GetEmailIdentity", "ListEmailIdentities", "DeleteEmailIdentity", "DeleteIdentity", "DeleteVerifiedEmailAddress", "ListIdentities", "ListVerifiedEmailAddresses", "GetIdentityVerificationAttributes", "GetIdentityDkimAttributes", "GetIdentityMailFromDomainAttributes", "GetIdentityNotificationAttributes", "SetIdentityDkimEnabled", "PutEmailIdentityDkimAttributes", "SetIdentityFeedbackForwardingEnabled", "PutEmailIdentityFeedbackAttributes", "SetIdentityMailFromDomain", "PutEmailIdentityMailFromAttributes", "SetIdentityNotificationTopic", "ListIdentityPolicies", "GetIdentityPolicies", "DeleteIdentityPolicy", "DeleteEmailIdentityPolicy", "CreateTemplate", "UpdateTemplate", "GetTemplate", "DeleteTemplate", "ListTemplates", "TestRenderTemplate", "CreateEmailTemplate", "UpdateEmailTemplate", "GetEmailTemplate", "DeleteEmailTemplate", "ListEmailTemplates", "TestRenderEmailTemplate", "SendEmail", "SendRawEmail", "SendTemplatedEmail", "SendBulkTemplatedEmail", "SendBulkEmail", "GetSendQuota", "GetAccount", "GetSendStatistics", "UpdateAccountSendingEnabled", "PutAccountSendingAttributes", "PutSuppressedDestination", "GetSuppressedDestination", "DeleteSuppressedDestination", "ListSuppressedDestinations", "CreateConfigurationSet", "DeleteConfigurationSet", "ListConfigurationSets", "GetConfigurationSet", "DescribeConfigurationSet", "UpdateConfigurationSetSendingEnabled", "PutConfigurationSetSendingOptions", "CreateConfigurationSetEventDestination", "UpdateConfigurationSetEventDestination", "DeleteConfigurationSetEventDestination", "GetConfigurationSetEventDestinations", "ListTagsForResource", "TagResource", "UntagResource"], "supported_operation_groups": ["Identity create/verify/get/list/delete (v1/v2)", "DKIM, MAIL FROM, feedback and notification settings", "SendEmail/SendRawEmail/SendTemplatedEmail/SendBulkTemplatedEmail and v2 SendBulkEmail", "Template CRUD/list/test-render (v1/v2)", "Configuration sets and SNS event destinations", "Send quota/statistics and account sending status", "Suppression destination CRUD/list", "Tags"], "behavior": ["Shared durable v1/v2 catalog and replayable MIME mailbox", "Route53 TXT/DKIM CNAME/MAIL FROM MX+SPF observation or explicit local verification", "Simple/raw/templated/bulk MIME, attachments and BCC header privacy", "Local SMTP acceptance with bounded sessions", "Real SNS and Logs acceptance/capture event notifications and suppression"], "options": { "LOCALAWS_SES_VERIFY_IDENTITIES=true": "Explicit bypass for local tests", "Transport": "Capture only; .eml plus recipient metadata under data_dir/mail", "DKIM": "DNS verification/configuration metadata; no cryptographic signing", "Delivery event": "Local capture acceptance, not external recipient delivery", "IdentityPolicy": "Sending authorization unsupported", "SMTP": "LOCALAWS_SMTP_LISTEN; local plaintext listener, no TLS/auth/outbound relay" }, "unsupported_features": ["Outbound email delivery", "Receiving rules/actions", "Custom cryptographic DKIM", "Sending authorization policies", "Full reputation/analytics and provider integrations"] }, "acm": { "protocols": ["AWS JSON 1.1 CertificateManager"], "supported_operations": ["RequestCertificate", "DescribeCertificate", "ListCertificates", "GetCertificate", "ImportCertificate", "DeleteCertificate", "AddTagsToCertificate", "RemoveTagsFromCertificate", "ListTagsForCertificate", "UpdateCertificateOptions", "RenewCertificate", "ExportCertificate"], "behavior": ["Real local-CA X.509 certificates and encrypted durable private material", "Route53 DNS validation before issuance, token TTL, timeouts and renewal", "Strict PEM/key/chain validation and imported-certificate replacement", "Actual SNI TLS for API Gateway custom domains and ALB HTTPS listeners", "Reference-protected deletion and live certificate replacement"], "options": { "ValidationMethod": "DNS only, observed from local Route53", "KeyAlgorithm": "Requested RSA_2048/EC_prime256v1/EC_secp384r1; supported imports validated by OpenSSL", "Export": "Explicit exportability option and encrypted private-key export", "TLS": "LOCALAWS_TLS_LISTEN; TLS 1.2/1.3, HTTP/1.1; trust local root from /_localaws/acm/trust-root.pem", "Renewal": "Eligible local-issued certificates reconciled every 60 seconds", "Legacy gateway restart": "Recreate API/ALB/DNS configuration; stale owned references retired at startup" }, "unsupported_features": ["Publicly trusted issuance", "ACM Private CA", "Email validation", "Managed external service certificates", "Full ALB SNI certificate-list APIs"] }, "elasticfilesystem": { "protocols": ["REST JSON /2015-02-01"], "supported_operations": ["CreateFileSystem", "DescribeFileSystems", "UpdateFileSystem", "DeleteFileSystem", "CreateMountTarget", "DescribeMountTargets", "DeleteMountTarget", "DescribeMountTargetSecurityGroups", "ModifyMountTargetSecurityGroups", "CreateAccessPoint", "DescribeAccessPoints", "DeleteAccessPoint", "TagResource", "UntagResource", "ListTagsForResource", "CreateTags", "DescribeTags", "DeleteTags", "DescribeLifecycleConfiguration", "PutLifecycleConfiguration", "DescribeBackupPolicy", "PutBackupPolicy", "DescribeFileSystemPolicy", "DeleteFileSystemPolicy", "UpdateFileSystemProtection"], "supported_operation_groups": ["File systems create/describe/update/delete", "Mount targets create/describe/delete and security groups", "Access points create/describe/delete", "Resource tags and legacy tag operations", "Lifecycle/backup/protection configuration describe and supported metadata updates"], "behavior": ["Durable catalog plus actual isolated backing directories", "EC2 VPC/subnet/AZ/security-group validation for target records", "Access-point directory isolation and logical UID/GID/mode checks", "Real ECS bind mounts with host permission validation and cleanup leases", "Deletion/write rollback on catalog failure"], "options": { "Encrypted=true": "UnsupportedOperation", "Mount targets": "Catalog records only; no NFS address/ENI is advertised", "LifecyclePolicies": "Validated metadata; all data remains Standard", "ThroughputMode": "Metadata only; host storage performance is unchanged", "BackupPolicy.Status=ENABLED": "UnsupportedOperation", "IAM/TLS/resource policies/replication": "UnsupportedOperation", "Lambda.FileSystemConfigs": "UnsupportedOperation before function mutation", "Leases": "Process-local; ECS catalog/lease reconstruction across restart unavailable" }, "unsupported_features": ["NFS network export", "Encrypted filesystem backend", "TLS/IAM mounts", "Automatic backups and replication", "Lifecycle data migration", "Lambda mounts", "Descriptor-based protection against external filesystem writer races"] }, "cloudtrail": { "protocols": [ "AWS JSON 1.1" ], "recognized_operations": [ "LookupEvents" ], "behavior": [ "Regional management history up to 90 days", "Eight lookup attributes, inclusive bounds, signed cursors, 2 calls/second/account/region" ], "unsupported": [ "Trail lifecycle", "Lake", "Insights", "S3 exports" ] }, "events": { "protocols": [ "AWS JSON 1.1 AWSEvents" ], "persistence": "Encrypted durable buses/rules/targets and bounded target outbox", "targets": [ "Lambda", "Step Functions", "SQS", "standard SNS", "authorized same-account/region CloudWatch Logs" ], "behavior": [ "Protected lifecycle producers and persistent original event IDs", "At-least-once external delivery, bounded retries/dead letters", "In-process lineage cycle/eight-hop guard" ], "unsupported": [ "InputTransformer", "Per-target RetryPolicy/DeadLetterConfig", "Cross-account Logs targets", "Distributed HTTP lineage propagation" ] }, "monitoring": { "protocols": [ "Query/XML 2010-08-01", "JSON 1.0 GraniteServiceVersion20100801", "Smithy RPC v2 CBOR" ], "supported_operations": [ "DeleteAlarms", "DeleteDashboards", "DescribeAlarmHistory", "DescribeAlarms", "DescribeAlarmsForMetric", "DisableAlarmActions", "EnableAlarmActions", "GetDashboard", "GetMetricData", "GetMetricStatistics", "ListDashboards", "ListMetrics", "ListTagsForResource", "PutDashboard", "PutMetricAlarm", "PutMetricData", "SetAlarmState", "TagResource", "UntagResource" ], "behavior": [ "Encrypted durable indexed minute measurements and five basic statistics", "Scheduled static M-of-N alarms, history and durable SNS/EventBridge transition delivery", "Account-global dashboards and actual StackPort metric/alarm widgets" ], "unsupported_features": [ "High resolution, expressions, percentile/anomaly/composite alarms", "Non-SNS or cross-account/region alarm actions", "GetMetricWidgetImage and full AWS Console compatibility" ], "contract": "tests/fixtures/monitoring/CONTRACT.md" }, "route53": { "protocols": [ "REST XML 2013-04-01" ], "supported_operations": [ "AssociateVPCWithHostedZone", "ChangeResourceRecordSets", "ChangeTagsForResource", "CreateHealthCheck", "CreateHostedZone", "DeleteHealthCheck", "DeleteHostedZone", "DisassociateVPCFromHostedZone", "GetChange", "GetHealthCheck", "GetHealthCheckCount", "GetHealthCheckStatus", "GetHostedZone", "GetHostedZoneCount", "ListHealthChecks", "ListHostedZones", "ListHostedZonesByName", "ListResourceRecordSets", "ListTagsForResource", "UpdateHealthCheck", "UpdateHostedZoneComment" ], "behavior": [ "Durable global hosted zones, records, changes, tags and health checks", "Real TCP/HTTP/HTTPS/string-match probes with one disclosed local observer", "Calculated/alarm checks and us-east-1 HealthCheckStatus metrics", "Cached primary/secondary DNS failover and actual ALB target health" ], "unsupported_features": [ "Geographic checker fleet, latency metrics, RECOVERY_CONTROL", "Weighted DNS, DNSSEC, traffic policies, private-zone DNS" ], "contract": "tests/fixtures/monitoring/CONTRACT.md" } }, "validation": { "verified_rust_tests": 960, "verified_python_tests": 13, "verified_live_checks": {"configuration_cli": 24, "expansion_cli_tls_smtp_restart": 58, "iam_cli_boto3_enforcement_terraform_stackport": 48}, "unit_and_integration": "cargo test", "configuration_cli": "python3 tests/configuration_live.py", "all_services_cli_tls_smtp_restart": "python3 tests/expansion_live.py", "iam_unit_and_integration": "cargo test --test iam_inventory_test and tests/iam_*_test.rs", "iam_cli_boto3_terraform_stackport": "python3 tests/iam_live.py --terraform --stackport", "limitations": ["Regional expansion Terraform fixtures remain deferred; IAM fixture is available", "Docker/LXD execution is covered through existing client fakes here, not a live host deployment"] }, "observability": { "defaults": { "enabled": true, "management_events": true, "data_events": "metadata-only", "cloudwatch_delivery": true, "lifecycle_events": true, "ec2_logs": false }, "journal": "/observability// (owner-only checksummed plaintext frames)", "coverage": "OBSERVABILITY_COVERAGE.json", "documentation": "docs/OBSERVABILITY.md", "limits": [ "Best effort can lose admissions; require-intent is not a resource/audit atomic transaction", "External targets are at least once; internal Logs dedup window covers retry age", "In-process lineage guards do not propagate through fresh external HTTP calls", "Guest collection is explicit, owned LXD only; SQL and SSH are outside gateway capture" ] } }