# localaws documentation

These guides are also available at /docs/. Service examples use Bash.

# Overview

localaws is an AWS-compatible cloud for your home lab. Use the AWS CLI, SDKs, and Terraform against one local HTTP endpoint. Docker runs container workloads; LXD runs EC2 instances.

## Start here

- [Quick start](#quick-start): launch the server and create your first bucket.
- [Installation](#installation): install a release or build from source.
- [Usage](#usage): configure credentials, discover resources, and clean up.
- Choose a service under Usage for its prerequisites and commands.

## Two addresses, two jobs

The AWS API listens at `http://localhost:4566` by default. The optional StackPort browser console listens at `http://localhost:8080` when started with `--ui`. Replace localhost with your server address when connecting from another machine.

Every signed request selects its service and region through the SigV4 credential scope. Use a region enabled in `config.json`; these examples use `us-east-1`.

## Local behavior

localaws implements a subset of AWS APIs. Some settings are metadata only, and some integrations need host services. Each resource guide calls out prerequisites. S3, IAM, messaging, logs, and several other catalogs persist locally; other service metadata remains in memory. Restarting can leave running containers without their old metadata.

The repository README, service guides, and `AWS_SERVICE_CAPABILITIES.json` describe the detailed compatibility limits. Do not assume full AWS parity.

## For automation and agents

[Start with the documentation index](llms.txt) to discover an individual Markdown page for every guide. [Download all guides in one request](llms-full.txt), or use the existing [complete Markdown reference](reference.md). These contain the same guides and commands as this site, without requiring JavaScript. [Download the example configuration](config.example.json) and [read the operation inventory](AWS_SERVICE_CAPABILITIES.json) for local capabilities.

Use explicit endpoints and regions in automation, read returned IDs instead of inventing them, and inspect resources before deleting them. Examples use demo names and assume a fresh installation.


---

# Quick start

Install the Linux x86_64 release from an empty directory. It requires glibc 2.36+, curl, tar, and sha256sum. Have the AWS CLI installed for the resource commands below.

```bash
curl -fsSL https://my-stack-prod-production.up.railway.app/install.sh | sh
cd localaws
export LOCALAWS_CONFIG=$PWD/config.json
./localaws > localaws.log 2>&1 &
```

Wait for the server to listen on port 4566; check `localaws.log` if it exits. Keep the same working directory and config for subsequent start and stop commands.

## Create, inspect, and delete a bucket

The example configuration has IAM enforcement off, so the test credentials below work for this S3 example. Use your authorized credentials when enforcement is enabled.

```bash
export LOCALAWS_ENDPOINT=http://localhost:4566
export AWS_ACCESS_KEY_ID=test AWS_SECRET_ACCESS_KEY=test
export AWS_DEFAULT_REGION=us-east-1 AWS_REGION=us-east-1
export AWS_PAGER=""
unset AWS_SESSION_TOKEN AWS_PROFILE AWS_DEFAULT_PROFILE
aws --endpoint-url "$LOCALAWS_ENDPOINT" s3api list-buckets
aws --endpoint-url "$LOCALAWS_ENDPOINT" s3api create-bucket --bucket hello-localaws
aws --endpoint-url "$LOCALAWS_ENDPOINT" s3api list-buckets
aws --endpoint-url "$LOCALAWS_ENDPOINT" s3api delete-bucket --bucket hello-localaws
```

The last command deletes the empty demo bucket. Choose a new bucket name if it already exists. For stored IAM keys required by STS, KMS, and some other APIs, follow [Usage](#usage).

## Add the browser console

Python 3.10+ with venv and pip is required. From the installed localaws directory:

```bash
python3 scripts/setup_ui.py
./localaws --stop
./localaws --ui > localaws.log 2>&1 &
```

Open `http://localhost:8080`. The console offers Dashboard, Resources, and guided Learn lessons. Its Documentation link returns here. Node.js is only needed to change the frontend.

## Stop the server

```bash
LOCALAWS_CONFIG=$PWD/config.json ./localaws --stop
```

This also stops the companion console. See [Installation](#installation) for host prerequisites and source builds.


---

# Installation

## Host prerequisites

- Linux x86_64 with glibc 2.36+ for the published binary.
- curl, tar, and sha256sum for the installer.
- AWS CLI for the examples; newer S3 families need CLI versions that include their service models.
- Docker for ECS tasks, RDS databases, Lambda runtimes, and the ECR registry.
- LXD with the lxc client for EC2 instances; ssh-keygen for key pairs.
- OpenSSL for ACM certificate operations.
- Python 3.10+ with venv and pip for the optional browser console.

## Published release

Run one installer command from an empty directory:

```bash
curl -fsSL https://my-stack-prod-production.up.railway.app/install.sh | sh
```

Or include the browser console's Python dependencies:

```bash
curl -fsSL https://my-stack-prod-production.up.railway.app/install.sh | sh -s -- -ui
```

The installer verifies the archive checksum, extracts `./localaws`, and creates `config.json`. It refuses to overwrite an existing localaws path. It does not start a server or install Docker or LXD. Both `-ui` and `--ui` are accepted by the installer.

Keep `stackport/` and `scripts/` next to the installed binary. From the installed directory, choose a launch mode:

```bash
cd localaws
export LOCALAWS_CONFIG=$PWD/config.json
./localaws --ui > localaws.log 2>&1 &
```

Use `./localaws` without `--ui` for the API alone. Stop an existing instance before switching modes.

## Update the executable

```bash
./localaws --update
```

Updates to the latest published Linux x86_64 binary, using the same archive and
SHA-256 verification as the installer. An identical binary reports that it is
already up to date. The command needs `tar` and write access to the executable's
directory; it does not require `LOCALAWS_CONFIG`. Download or verification failures
leave the existing executable intact. Restart a running server to use the update.

Configuration, data, and bundled browser-console files are preserved. To update
the console as well, install a fresh bundle in another directory and retain your
configuration and data. Set `LOCALAWS_DOWNLOAD_BASE_URL` to use a custom download
origin. Updates require HTTPS, except for HTTP on loopback hosts (`localhost`,
`127.0.0.1`, or `::1`); redirects follow the same rule.
Updates follow the latest published build by binary contents; the current
publication does not provide semantic version ordering.

## Build from source

From a source checkout, install Rust 1.92 and copy the example configuration:

```bash
rustup toolchain install 1.92
cp config.example.json config.json
export LOCALAWS_CONFIG=$PWD/config.json
make start
# Stop the background server:
make stop
```

For the console in a source checkout:

```bash
python3 scripts/setup_ui.py
make start ARGS=--ui
```

The frontend build is committed, so normal use needs no Node.js installation.

## Configuration

Set `LOCALAWS_CONFIG` to an absolute config path. The example binds the AWS API to `0.0.0.0:4566`, stores local state under `./data`, and enables several regions. Relative data paths resolve from the server's working directory.

The `iam.enforcement` setting controls authorization: `off`, `record`, `iam-only`, or `all`. Stored IAM credentials still undergo signature validation when enforcement is off. Configure credentials before enabling enforcement.

StackPort listens on all network interfaces and has no login. Use it on a trusted network. Set `STACKPORT_PORT=9090` to change its port, or `STACKPORT_ALLOW_WRITES=false` to block console changes. Lambda invocation remains available and can have side effects. When credentials are omitted, the localaws launcher provisions console credentials; supply both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY to use your own.

[Download config.example.json](config.example.json) for the complete starting configuration. Optional providers, such as S3 Files NFS and Outposts, require additional configuration described in the repository's service guides.


---

# Usage

Select a service in the left navigation for a creation example, prerequisites, and discovery commands. The examples use Bash and demo names on a fresh localaws installation.

## Connect the AWS CLI

For an unmodified example configuration with IAM enforcement off:

```bash
export LOCALAWS_ENDPOINT=http://localhost:4566
export AWS_ACCESS_KEY_ID=test AWS_SECRET_ACCESS_KEY=test
export AWS_DEFAULT_REGION=us-east-1 AWS_REGION=us-east-1
export AWS_PAGER=""
unset AWS_SESSION_TOKEN AWS_PROFILE AWS_DEFAULT_PROFILE
```

Replace localhost for a remote server and select a configured region. Always include `--endpoint-url "$LOCALAWS_ENDPOINT"`; this directs the command to your local server.

## Create stored credentials

STS and KMS require stored keys even when enforcement is off. With the fresh example configuration, create a demo administrator, then use its returned credentials:

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" iam create-user --user-name demo-cli-user
aws --endpoint-url "$LOCALAWS_ENDPOINT" iam put-user-policy \
  --user-name demo-cli-user --policy-name demo-local-admin \
  --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"*","Resource":"*"}]}'
read -r AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY <<< "$(aws --endpoint-url "$LOCALAWS_ENDPOINT" iam create-access-key \
  --user-name demo-cli-user --query 'AccessKey.[AccessKeyId,SecretAccessKey]' --output text)"
export AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
aws --endpoint-url "$LOCALAWS_ENDPOINT" sts get-caller-identity
```

This grants broad local permissions. If IAM enforcement is already enabled, use existing authorized credentials and skip this bootstrap. Keep returned secrets private. Repeatable scripts should reuse an existing demo user or choose unique names.

## Discover and inspect resources

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" s3api list-buckets
aws --endpoint-url "$LOCALAWS_ENDPOINT" dynamodb list-tables
aws --endpoint-url "$LOCALAWS_ENDPOINT" ec2 describe-instances
```

The localaws binary accepts server startup, `--ui`, and `--stop`; it has no native resource-list or delete subcommands. Use service-specific AWS CLI or SDK calls for headless management.

In the browser console, Dashboard shows service counts and Resources provides service views. Some localaws APIs have no console view; their CLI commands still work. Learn lessons create real local resources.

## SDKs and scripts

Use the same endpoint, credentials, and region with SDK clients. This Python example requires boto3 installed in your environment:

```python
import os
import boto3

s3 = boto3.client(
    "s3",
    endpoint_url=os.environ["LOCALAWS_ENDPOINT"],
    region_name=os.environ.get("AWS_DEFAULT_REGION", "us-east-1"),
)
print([bucket["Name"] for bucket in s3.list_buckets()["Buckets"]])
```

For Terraform, point every used service endpoint at localaws. The repository's terraform directory contains complete examples and acceptance fixtures.

## Delete deliberately

Use the IDs, URLs, and ARNs returned by create/list operations. Inspect the selected resource first. Empty S3 buckets before deletion; versioned buckets also require deleting versions and delete markers. Remove dependent resources before their parent. Terminating instances and deleting databases can discard workload data.

```bash
# These remove the empty resources with these exact demo names:
aws --endpoint-url "$LOCALAWS_ENDPOINT" s3api delete-bucket --bucket demo-bucket
aws --endpoint-url "$LOCALAWS_ENDPOINT" dynamodb delete-table --table-name demo-items
```

Stopping localaws is separate from resource deletion. Persistent catalogs survive restarts, and workload containers can outlive memory-only metadata. Back up data directories together with their encryption keys.

## Troubleshooting

- Connection refused: check localaws.log, the configured listener, and whether the server is running.
- InvalidRegion: choose a region in config.json.
- Access denied or signature errors: verify credentials, session token, region, and IAM enforcement mode.
- Unsupported operation: check the operation inventory and the service guide; localaws implements a subset of AWS.
- Container or instance failures: check Docker or LXD access on the server host.
- Console unavailable: run scripts/setup_ui.py, check STACKPORT_PORT, and restart with --ui.


---

# S3

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Create a general-purpose bucket in us-east-1.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" s3api create-bucket --bucket demo-bucket
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" s3api list-buckets
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# DynamoDB

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Create a table with a string partition key and on-demand billing.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" dynamodb create-table \
  --table-name demo-items \
  --attribute-definitions AttributeName=id,AttributeType=S \
  --key-schema AttributeName=id,KeyType=HASH \
  --billing-mode PAY_PER_REQUEST
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" dynamodb list-tables
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# Kinesis

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Local Kinesis supports one shard per stream.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" kinesis create-stream \
  --stream-name demo-stream --shard-count 1
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" kinesis list-streams
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# Lambda

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Requires Docker and Python 3. Creates its own execution role and ZIP package; Python 3.12 is in the example configuration.

```bash
LAMBDA_ROLE=$(aws --endpoint-url "$LOCALAWS_ENDPOINT" iam create-role \
  --role-name demo-lambda-role \
  --assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"lambda.amazonaws.com"},"Action":"sts:AssumeRole"}]}' \
  --query Role.Arn --output text)
python3 - <<'PYTHON'
import zipfile
with zipfile.ZipFile("demo-function.zip", "w") as archive:
    archive.writestr("handler.py", 'def handler(event, context):\n    return {"message": "Hello from localaws"}\n')
PYTHON
aws --endpoint-url "$LOCALAWS_ENDPOINT" lambda create-function \
  --function-name demo-function --runtime python3.12 --handler handler.handler \
  --role "$LAMBDA_ROLE" --zip-file fileb://demo-function.zip
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" lambda list-functions
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# ECS

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates an empty cluster. Running tasks in it requires Docker.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" ecs create-cluster --cluster-name demo-cluster
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" ecs list-clusters
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# ECR

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Requires Docker; the local registry starts on first use.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" ecr create-repository --repository-name demo-app
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" ecr describe-repositories
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# EC2

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Requires LXD. Uses the configured Ubuntu image and the default us-east-1 subnet; leave NO_DEFAULTS unset.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" ec2 run-instances \
  --image-id ami-ubuntu-2404 --instance-type t3.micro --count 1
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" ec2 describe-instances
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# VPC networking (EC2)

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates a network record. Local VPCs do not change the host network.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" ec2 create-vpc --cidr-block 10.42.0.0/16
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" ec2 describe-vpcs
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# EFS

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates local filesystem storage. Encryption and AWS Backup must remain disabled; no NFS endpoint is advertised.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" efs create-file-system \
  --creation-token demo-efs --no-encrypted --no-backup \
  --tags Key=Name,Value=demo-files
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" efs describe-file-systems
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# RDS

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Requires Docker. The password is for this local example; choose your own before using the database.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" rds create-db-instance \
  --db-instance-identifier demo-db --engine postgres --db-instance-class db.t3.micro \
  --allocated-storage 20 --master-username demo --master-user-password 'LocalDemoPass123!'
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" rds describe-db-instances
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# IAM

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates an IAM user. Access keys are created separately with iam create-access-key.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" iam create-user --user-name demo-user
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" iam list-users
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# STS

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

STS has no create-resource API. This supported call shows the account and identity used for requests.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" sts get-caller-identity
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" sts get-caller-identity
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# KMS

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates a local symmetric encryption key.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" kms create-key
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" kms list-keys
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# Secrets Manager

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Stores a local example secret.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" secretsmanager create-secret \
  --name demo/credentials --secret-string '{"username":"demo","password":"local-example"}'
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" secretsmanager list-secrets
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# SSM Parameter Store

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

PutParameter creates a named parameter.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" ssm put-parameter \
  --name /demo/greeting --type String --value 'Hello from localaws'
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" ssm describe-parameters
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# SQS

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates a standard queue.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" sqs create-queue --queue-name demo-queue
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" sqs list-queues
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# SNS

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates a standard notification topic.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" sns create-topic --name demo-topic
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" sns list-topics
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# SES

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates a local identity with the SES v2 API. Verification is a separate step; local mail is captured rather than sent externally.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" sesv2 create-email-identity \
  --email-identity demo@example.com
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" sesv2 list-email-identities
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# ACM

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Requests a certificate from the local CA. Add the returned DNS validation records to local Route 53 to complete issuance.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" acm request-certificate \
  --domain-name demo.example.com --validation-method DNS
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" acm list-certificates
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# API Gateway

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates an empty REST API; add resources, methods and a deployment before invoking it.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" apigateway create-rest-api --name demo-api
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" apigateway get-rest-apis
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# Route 53

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates a local hosted zone.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" route53 create-hosted-zone \
  --name demo.example.com --caller-reference "demo-$(date +%s)"
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" route53 list-hosted-zones
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# Route 53 Domains

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates a local registry entry and hosted zone. This does not register a domain on the public internet.

```bash
CONTACT='{"FirstName":"Demo","LastName":"User","ContactType":"PERSON","AddressLine1":"123 Example St","City":"Seattle","State":"WA","CountryCode":"US","ZipCode":"98101","PhoneNumber":"+1.2065550100","Email":"demo@example.com"}'
aws --endpoint-url "$LOCALAWS_ENDPOINT" route53domains register-domain \
  --domain-name localaws-demo.com --duration-in-years 1 \
  --admin-contact "$CONTACT" --registrant-contact "$CONTACT" --tech-contact "$CONTACT"
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" route53domains list-domains
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# ELBv2 / ALB

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates its own VPC and two subnets in different availability zones. Add a target group and listener to route requests.

```bash
VPC_ID=$(aws --endpoint-url "$LOCALAWS_ENDPOINT" ec2 create-vpc \
  --cidr-block 10.43.0.0/16 --query Vpc.VpcId --output text)
SUBNET_A=$(aws --endpoint-url "$LOCALAWS_ENDPOINT" ec2 create-subnet \
  --vpc-id "$VPC_ID" --cidr-block 10.43.1.0/24 --availability-zone us-east-1a \
  --query Subnet.SubnetId --output text)
SUBNET_B=$(aws --endpoint-url "$LOCALAWS_ENDPOINT" ec2 create-subnet \
  --vpc-id "$VPC_ID" --cidr-block 10.43.2.0/24 --availability-zone us-east-1b \
  --query Subnet.SubnetId --output text)
aws --endpoint-url "$LOCALAWS_ENDPOINT" elbv2 create-load-balancer \
  --name demo-alb --type application --scheme internet-facing \
  --subnets "$SUBNET_A" "$SUBNET_B"
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" elbv2 describe-load-balancers
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# EventBridge

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates a custom event bus. Add rules and targets to deliver events.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" events create-event-bus --name demo-bus
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" events list-event-buses
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# Step Functions

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates its own service role and a minimal Pass workflow.

```bash
STATES_ROLE=$(aws --endpoint-url "$LOCALAWS_ENDPOINT" iam create-role \
  --role-name demo-states-role \
  --assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"states.amazonaws.com"},"Action":"sts:AssumeRole"}]}' \
  --query Role.Arn --output text)
aws --endpoint-url "$LOCALAWS_ENDPOINT" stepfunctions create-state-machine \
  --name demo-workflow --role-arn "$STATES_ROLE" \
  --definition '{"StartAt":"Hello","States":{"Hello":{"Type":"Pass","Result":"Hello from localaws","End":true}}}'
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" stepfunctions list-state-machines
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# CloudWatch Logs

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates a group and a stream ready for log events.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" logs create-log-group --log-group-name /demo/app
aws --endpoint-url "$LOCALAWS_ENDPOINT" logs create-log-stream \
  --log-group-name /demo/app --log-stream-name demo-stream
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" logs describe-log-groups
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# CloudTrail

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Local management history is recorded automatically with the example configuration. Trail creation is unsupported; look up the events from your other commands.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" cloudtrail lookup-events --max-results 10
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" cloudtrail lookup-events --max-results 10
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# S3 Control

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Creates its own bucket. S3 Control adds the account to the request hostname; the proxy settings below route that hostname to localaws without extra DNS setup.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" s3api create-bucket --bucket demo-access-bucket
ACCOUNT_ID=$(aws --endpoint-url "$LOCALAWS_ENDPOINT" sts get-caller-identity \
  --query Account --output text)
HTTP_PROXY="$LOCALAWS_ENDPOINT" http_proxy="$LOCALAWS_ENDPOINT" NO_PROXY= no_proxy= \
  aws --endpoint-url "$LOCALAWS_ENDPOINT" s3control create-access-point \
  --account-id "$ACCOUNT_ID" --name demo-access --bucket demo-access-bucket
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
HTTP_PROXY="$LOCALAWS_ENDPOINT" http_proxy="$LOCALAWS_ENDPOINT" NO_PROXY= no_proxy= \
  aws --endpoint-url "$LOCALAWS_ENDPOINT" s3control list-access-points --account-id "$ACCOUNT_ID"
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# S3 Tables

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Requires an AWS CLI version with the s3tables service model.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" s3tables create-table-bucket --name demo-tables
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" s3tables list-table-buckets
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# S3 Vectors

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

Requires an AWS CLI version with the s3vectors service model. Vector search is local and exact.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" s3vectors create-vector-bucket \
  --vector-bucket-name demo-vectors
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" s3vectors list-vector-buckets
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# S3 Files

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

First configure s3.files_nfs on the server and use an AWS CLI with the s3files service model. This example creates a versioned bucket and a service role with access to that bucket. Without the NFS provider, creation returns an unsupported error.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" s3api create-bucket --bucket demo-files-bucket
aws --endpoint-url "$LOCALAWS_ENDPOINT" s3api put-bucket-versioning \
  --bucket demo-files-bucket --versioning-configuration Status=Enabled
FILES_ROLE=$(aws --endpoint-url "$LOCALAWS_ENDPOINT" iam create-role \
  --role-name demo-files-role \
  --assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"s3files.amazonaws.com"},"Action":"sts:AssumeRole"}]}' \
  --query Role.Arn --output text)
aws --endpoint-url "$LOCALAWS_ENDPOINT" iam put-role-policy \
  --role-name demo-files-role --policy-name demo-files-access \
  --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":["arn:aws:s3:::demo-files-bucket","arn:aws:s3:::demo-files-bucket/*"]}]}'
aws --endpoint-url "$LOCALAWS_ENDPOINT" s3files create-file-system \
  --bucket arn:aws:s3:::demo-files-bucket --role-arn "$FILES_ROLE"
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" s3files list-file-systems
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.


---

# S3 on Outposts

[Complete the CLI and credentials setup](#usage) before running these Bash examples. Use stored credentials for all service guides so STS and KMS calls work too.

First configure an Outpost under s3.regional.outposts. Set OUTPOST_ID, OUTPOST_SUBNET_ID and OUTPOST_SECURITY_GROUP_ID to that configured record’s IDs. Use the stored credentials from the setup above; Outposts requests require verified credentials and permission for s3-outposts:CreateEndpoint.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" s3outposts create-endpoint \
  --outpost-id "${OUTPOST_ID:?Set the configured Outpost ID}" \
  --subnet-id "${OUTPOST_SUBNET_ID:?Set the configured subnet ID}" \
  --security-group-id "${OUTPOST_SECURITY_GROUP_ID:?Set the configured security group ID}" \
  --access-type Private
```

## Inspect resources

List the local resources and use the returned identifiers for detail or cleanup calls.

```bash
aws --endpoint-url "$LOCALAWS_ENDPOINT" s3outposts list-endpoints
```

## Local compatibility

These commands target localaws. Support depends on the configured host and providers; AWS feature parity is limited. Consult the [operation inventory](AWS_SERVICE_CAPABILITIES.json) for supported actions and the [usage guide](#usage) for cleanup and troubleshooting.