AI and security briefsTools

Should my team test against AWS Emulator instead of a real AWS account?

By Brandon Da Costa, founder of Digiton Dynamics

Published 12 November 2026Updated 12 November 2026Editorial policy

AWS made AWS Emulator generally available on 11 November 2026. It serves AWS APIs on your own machine for tests and coding agents, with no extra fee. Try it on one suite, and keep a real AWS run for anything about IAM, accounts or Regions, which it does not model.

Who should act: Teams whose tests or coding agents deploy to a real AWS account just to check that an AWS call works, and teams that want agents working without real cloud credentials.

What changed

AWS made AWS Emulator generally available on 11 November 2026 (AWS News Blog, 11 November). It is a local program that serves AWS APIs over HTTPS on 127.0.0.1:9297. The AWS CLI, the SDKs and coding agents such as Kiro or Claude Code talk to it with the same API calls, and your application code stays unchanged. There is no extra service fee. Linux installs from an RPM or Debian package, macOS and Windows run it in Docker, and AWS does not publish a ready-made image. The source is public on GitHub under the CC0 licence (GitHub repository, 12 November).

Each start generates new credentials whose key IDs begin with EMULATOR, and it rejects requests signed with any other keys. Every emulator holds one account, 000000000000. An operation it has not implemented returns HTTP 501, so a test fails at once instead of passing by luck. For Rust tests, an embedded mode runs one isolated instance inside the test process (AWS News Blog, 11 November). AWS says agents build and maintain the emulator from the AWS API models, and that an independent security agent reviews each change.

The limits matter as much as the features. It does not evaluate IAM policies or resource policies the way AWS does, so a request AWS denies can succeed. There is no cross-account or cross-Region behaviour, and how closely it matches AWS varies by service. AWS publishes a fidelity score per service with each release, as k of n tests passed. By default it sends anonymous usage and error data, and you can turn that off.

Who it affects

• Teams that deploy to a shared dev account to run integration tests. AWS's own walkthrough covers S3 and DynamoDB, so start there.
• Teams letting coding agents create cloud resources to check their work. A local endpoint lets an agent loop without real AWS credentials in its environment.
• Anyone testing IAM, bucket policies or any security setting. AWS says not to use the emulator for that.
• Rust teams eyeing embedded mode. AWS's README says the first build and target directory can be as large as a build from source, which wants at least 100 GB of free disk.

What we checked

Run on 12 November 2026 on the Mac that builds this site. Each command and its output are copied as they ran.

$ curl -s https://aws.amazon.com/blogs/aws/test-your-applications-against-aws-locally-with-aws-emulator/ | grep -o -E 'evaluate IAM policies the way AWS does|each emulator acts as a single account' | sort -u
each emulator acts as a single account
evaluate IAM policies the way AWS does

$ curl -s https://api.github.com/repos/aws/aws-emulator | grep -m1 spdx_id
    "spdx_id": "CC0-1.0",

Both limits are in AWS's launch post and the licence is CC0 as of today.

What to do now

1. Pick one suite that touches a few services. Look up each service in the fidelity scores in AWS's documentation before you spend an hour on it.
2. Start the emulator, set the environment variables from AWS's guide, and confirm you hit it and not a real account.

   curl --cacert ~/.aws/emulator/9297/ca.pem https://127.0.0.1:9297/__admin/health
   aws sts get-caller-identity

3. Unset real credentials in the shell that runs the tests, then run the suite and list every 501.

   unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN AWS_PROFILE

4. Keep a run against real AWS in the pipeline before production. It is the only place IAM, policies, accounts and Regions get tested.
5. Pin the emulator version in CI and decide whether the usage data stays on. The switch is in AWS's documentation.

What to watch

• Fidelity scores per service on each release. AWS warns a score can fall when it adds tests.
• The open gaps AWS tracks in the repository's issues folder.
• How an emulator built and reviewed by agents holds up on the services you use.
• Any IAM evaluation. AWS lists its absence as a launch limit.

Questions people ask

Digiton's production review checks that tests, staging and production each hold their own credentials and that nothing local stands in for a security check, and the checks are on the vibe coded app audit page.

How this brief was made: researched from the sources below, drafted with AI assistance and checked against each source on the dates shown. See the editorial policy.

Sources

1. AWS News Blog, Test your applications against AWS locally with AWS Emulator, 11 November 2026, read 12 November 2026. https://aws.amazon.com/blogs/aws/test-your-applications-against-aws-locally-with-aws-emulator/
2. aws/aws-emulator repository README, read 12 November 2026. https://github.com/aws/aws-emulator
3. aws/aws-emulator licence file, read 12 November 2026. https://raw.githubusercontent.com/aws/aws-emulator/main/LICENSE

More briefs

How these briefs are sourced and corrected. All AI and security briefs