AWS Emulator puts a local copy of AWS on your laptop. The builder tip: iterate there, test permissions on real AWS

• You install it from an RPM or Debian package on Linux, or run it in Docker on macOS and Windows. AWS doesn't publish a ready-made image; you build one from a short Dockerfile in the docs.
• It serves HTTPS on 127.0.0.1:9297 by default, generates its own keys at startup and rejects requests signed with any other keys. Its access key IDs start with EMULATOR.
• You point your tools at it with environment variables such as AWS_ENDPOINT_URL. Your application code stays the same.
• State lives in memory until you stop it. Each copy gets its own port, keys and state, so agents, test suites and CI jobs don't see each other's resources.
• Operations it doesn't support yet return HTTP 501 Not Implemented, so a test fails right away.
• AWS publishes a fidelity score per service (for example, 40 of 50 tests passing), and the fidelity tests are public on GitHub.

Who built it. AWS says the emulator was written entirely by AI agents. "Our team hasn't written or reviewed any of the code," AWS senior principal engineer Matthew Goldberg wrote in About Amazon (opens in a new tab). In AWS's account, one team of agents writes fidelity tests and checks each against real AWS, a second finds where the emulator differs, and a third fixes each issue. Every change must pass a merge gate that includes agent code reviewers and security agents. GeekWire (opens in a new tab) and InfoWorld (opens in a new tab) reported the launch. That is AWS's description of its own process; MODEL hasn't reviewed the code.

The catch.

• It doesn't evaluate IAM policies or resource-based policies the way AWS does. AWS's own warning: a request that AWS denies might succeed in the emulator. Don't use it to test whether your app is secure.
• Each emulator acts as a single account, with no cross-account or cross-Region behavior.
• How closely it matches AWS varies by service and feature. An IDC analyst told InfoWorld it doesn't simulate throttling, outages or per-Region availability at launch.
• By default it sends anonymous usage and error data. You can turn that off.

The builder tip. A local emulator is a good place for a coding agent to make its mistakes: it can create a table, break it and retry in milliseconds without touching your account or your bill. Two rules keep that safe. First, keep real AWS credentials out of the environment the agent and your tests run in; AWS's walkthrough unsets them before pointing the CLI at the emulator. Second, treat a green run as proof your code calls AWS correctly, not proof it's allowed to. Run your permission and security tests on real AWS before you ship, and check the fidelity score for each service you rely on.

Disclosure: Not tested by MODEL. Not sponsored. No affiliate links.

MODEL Editors