AWS Emulator: a free local AWS written by AI agents

On Wednesday 11 November, AWS released AWS Emulator: a free program that runs on your own machine and answers AWS API calls, so tests can run without an AWS account, a network connection or a bill. AWS says it is built from more than 400 API models covering more than 200 services. The part that made headlines is who wrote it. "Our team hasn't written or reviewed any of the code," writes Matthew Goldberg, the senior principal engineer behind the project. Autonomous agents wrote it, and they maintain it too.

Here is what it is, how to point your code at it, the limits AWS states up front, and how it compares with LocalStack on paper.

What AWS Emulator is

It is a single local server, written in Rust, with no graphical interface. You start it, point the AWS CLI or an SDK at it, and your code talks to it instead of AWS. The README puts the purpose in one line: "You use it to test your software without calling AWS."

The facts from the README and the user guide:

Price	No additional service fee
Licence	CC0-1.0 (public domain dedication); vendor/ is Apache 2.0
Linux	RPM or Debian package, x86_64 and aarch64
macOS and Windows	Docker, from an image you build with the project's Dockerfile
Endpoint	One HTTPS endpoint for every service, https://127.0.0.1:9297 by default, self-signed certificate
State	In memory, deleted when the emulator stops
Scope	One Region and one account per emulator
Telemetry	On by default, can be turned off

There is also an embedded mode for Rust tests, which runs the emulator in-process, and an agent skill you add with aws agent-toolkit add-skill --skill-name aws-emulator --region us-east-1 (AWS CLI 2.35.0 or later). The skill tells you who the intended user is. AWS describes the emulator as giving coding agents "a local copy of AWS to test against."

How to point your code at it

On Linux you install the package and run aws-emulator. At startup it generates a fresh access key, a config file and a CA certificate under ~/.aws/emulator/9297/. You then set environment variables in the shell that runs your tests. From the user guide, for macOS and Linux:

export AWS_ENDPOINT_URL=https://127.0.0.1:9297
export AWS_SHARED_CREDENTIALS_FILE=~/.aws/emulator/9297/emulator_credentials
export AWS_CONFIG_FILE=~/.aws/emulator/9297/config
export AWS_CA_BUNDLE=~/.aws/emulator/9297/ca.pem
export AWS_EC2_METADATA_DISABLED=true
export AWS_DISABLE_HOST_PREFIX_INJECTION=true
export AWS_REGION=us-east-1
export AWS_DEFAULT_REGION=us-east-1

Three details in the guide are easy to miss:

• Unset your real credentials first. The guide tells you to clear AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN and AWS_PROFILE, so a stray variable cannot send a test to your real account.
• Node.js needs a different certificate variable. AWS_CA_BUNDLE covers the AWS CLI, Boto3 and the Go SDK. The AWS SDK for JavaScript v3 needs NODE_EXTRA_CA_CERTS set to the same ca.pem. Java, Rust and .NET each have their own setting.
• Use 127.0.0.1, not localhost. The certificate also changes on every start, so do not cache it in CI.

To confirm you are talking to the emulator, run aws sts get-caller-identity. It reports account 000000000000.

To turn telemetry off, start it with aws-emulator --telemetry off or set EMULATOR_TELEMETRY=off.

The limits AWS states up front

The README is blunt: "Don't use it for production workloads or to test security." The user guide adds more:

• It does not evaluate IAM policies the way AWS does. A test that passes locally says nothing about whether your role has the right permissions.
• Everything is in memory. Stop the emulator and the tables, queues and buckets are gone.
• It is not tested for long-running use or for load, so it is not a performance testing tool.
• Known mismatches are public. Behaviours that do not match AWS yet are listed in the repository under issues/things-that-do-not-work/. Fixed ones move to issues/things-that-now-work/.

That folder is the most useful thing in the repository. Before you trust the emulator for a service, search it for the operations your code calls. The user guide says fidelity scores are published with each release. On 12 November at least one recent entry on the releases page read "Scores are not available for this release", so check the release you install.

Agents wrote it, and it does not take pull requests

AWS's engineering post describes three teams of agents. One writes fidelity tests from the public API models and verifies each test against real AWS. One replays those tests against the emulator and files an issue for every mismatch. One fixes issues, one agent per issue, and each fix has to pass a merge gate of build, review, security and fidelity checks. AWS says the recorded tests number in the "tens of thousands" and can be replayed without calling AWS again, and that Kiro produced a first version of SQS in 15 minutes and the rest of AWS over a weekend. Kiro is the same AWS agent tool whose bots featured in last week's multi-agent round-up.

Two consequences matter if you depend on it:

• You cannot upstream a fix. The README says the repository does not take pull requests. You file bugs and fidelity gaps as GitHub issues, and agents pick them up.
• It moves fast. The releases page showed v1.0.322 as the latest on 11 November, published by a CI account, with dozens of releases in the three days before it. Pin a version in CI.

"No human reviewed it" needs one qualifier, which AWS supplies itself. A guest post on Werner Vogels' blog says the code "was written and tested by agents" and that "an engineer built the scaffolding that runs them." The humans moved from reviewing code to building the test oracle that decides whether code is correct. For an emulator that oracle is unusually strong, because the real service exists and can answer every question. Most projects do not have one, so read this as a result about emulators, not about software in general.

AWS Emulator vs LocalStack, on paper

LocalStack is the established tool for this job. From its pricing page on 12 November 2026:

	AWS Emulator	LocalStack Hobby	LocalStack Base	LocalStack Ultimate
Price	Free	Free	$39 per licence per month, billed annually	$89 per licence per month, billed annually
Commercial use	Allowed (CC0)	Not allowed	Yes	Yes
Services listed	200+	30+	55+	110+

On paper AWS Emulator covers more services, costs nothing and has no commercial-use restriction. What the table cannot show is depth: how many operations per service behave correctly, and how each tool handles persistence, IAM and deployment tooling. LocalStack has years of real projects behind it. AWS Emulator has a public list of what is broken and a machine working through it. Neither replaces a staging account for the checks that matter most.

Who should try it now

• Integration tests that call SQS, DynamoDB, S3 and similar APIs, where today you mock the SDK by hand or pay for a test account. Start with the behaviour your code depends on at the edges. AWS's own worked example is the SQS visibility timeout, the same mechanism the SQS producer and consumer tutorial relies on. For the idempotent write pattern, the test is whether a duplicate transaction is cancelled with the same reason real DynamoDB gives.
• Coding agents that need to run AWS code in a sandbox without real credentials. This is the use AWS built it for.
• Not yet: anything that checks permissions, anything that needs data to survive a restart, load tests, and any service whose operations still sit in the does-not-work folder.

Also announced on 11 November

Google launched the Gemini Decisions API, an endpoint for closed questions rather than generated text. You send one input (text, images, audio, video or PDFs) and up to 1,000 questions, each a yes/no, a choice between 2 and 255 options, or a score on a rubric. Every answer comes back with a confidence score from 0 to 1, so code can send the uncertain cases to a fallback or a person.

Google prices it at $0.10 per million input tokens with no charge for output, and claims 150 to 250 ms end-to-end latency. That latency figure is Google's own and has not been independently measured. It is available now through the Gemini API in Google AI Studio, with Google Cloud support listed as coming soon. The obvious uses are routing a request to the right model, choosing a tool, and running policy checks in front of an agent.

The short version

• AWS Emulator is a free, CC0-licensed local stand-in for 200+ AWS services. It runs natively on Linux and through Docker on macOS and Windows, on https://127.0.0.1:9297.
• Agents wrote and maintain it. No pull requests are accepted, releases land many times a day, and known gaps are listed in the repository.
• Use it for fast, offline tests of API behaviour. Do not use it for IAM and security testing, persistence, load tests or production.
• Before you rely on it, unset your real credentials, set NODE_EXTRA_CA_CERTS if you are on Node.js, turn telemetry off if you want to, and check the does-not-work folder for the operations you call.
• Gemini Decisions API gives cheap, fast, closed-set answers with confidence scores at $0.10 per million input tokens.

Frequently asked questions

Is AWS Emulator free?

Yes. The README says it has no additional service fee, and the code is released under CC0-1.0, a public domain dedication, apart from a vendor folder under Apache 2.0. You pay only for real AWS resources when you deploy.

Does AWS Emulator need an AWS account or an internet connection?

No. Requests go to a local endpoint, https://127.0.0.1:9297 by default, and the emulator generates its own throwaway credentials at startup. It does send anonymous usage data to AWS by default, which you can turn off with --telemetry off.

Can I use AWS Emulator to test IAM policies or security?

No. AWS says not to use it for production workloads or to test security, and the user guide says it does not evaluate IAM policies the way AWS does. Test permissions against a real account.

Does AWS Emulator keep data between runs?

No. The user guide says all resources are held in memory and deleted when the emulator stops, and that each emulator covers one Region and one account.