Can AWS Emulator replace the LocalStack container in your CI pipeline? Picture a platform lead who pinned a pre-March LocalStack image because older tags still start without an auth token. LocalStack’s release post says 2026.03.0 and every later version require an auth token or CI auth token at startup. LocalStack’s terms limit the free Hobby plan to personal, educational and non-commercial use. The Hobby plan includes more than 30 emulated services, according to LocalStack’s pricing page. AWS released AWS Emulator on November 11 at no additional fee, under CC0 except Apache 2.0 code in vendor/.
The AWS News Blog says the emulator supports the APIs of AWS services that have an API model. The post says the emulator is built from the AWS SDKs’ API models, so request and error shapes match AWS. AWS senior principal engineer Matthew Goldberg wrote that autonomous agents produced all of the emulator’s code. Initially, the repository contained an empty web server that could handle requests for 438 AWS API models but “did nothing.” Goldberg says his team hasn’t reviewed any of the code. According to the AWS News Blog, an independent security agent checks changes during each fix and in the release pipeline.
AWS Emulator Passes 63 Percent of Its Behavioral Tests
AWS scores the emulator with fidelity tests, short AWS SDK programs that run a workflow and assert how AWS behaves. A test passes only when the emulator matches AWS on every call, including the status code, the resources it creates and other side effects. An unimplemented operation returns HTTP 501 with the error code NotImplemented, so any test that calls one fails right away. The evaluation suite README says every test was verified against at least two sandboxed AWS accounts. AWS attaches a scores file with the result of every test to each AWS Emulator release on GitHub.
The emulator passes 20,364 of 32,322 behavioral tests in the v1.0.322 scores file, published the evening of November 10. The overall pass rate is 63 percent at the time of this writing, with the 80 skipped tests left out of the count. AWS’s evaluation suite manifest labels about 90 percent of those tests as control plane, data plane or both. Among the labeled tests, the emulator passes 67 percent of control plane tests and 54 percent of data plane tests. Cross-service tests, the 6,380 scored tests whose names start with a prefix like lambda__s3, pass at 42 percent.
KMS passes 233 of 241 tests, and SQS 286 of 304. S3 passes 83 percent and DynamoDB 82 percent, against 48 percent for Lambda and 44 percent for EC2. Systems Manager ranks last of the 16 charted services, passing 72 of 277 tests. Tests with the lambda__s3 prefix pass 24 of 65, against 22 of 24 for dynamodb__lambda__s3.
The user guide says the emulator updates many times a day. The fidelity page says to compare scores only when they use the same version of the fidelity tests.
AWS Emulator Next to LocalStack, Moto and SAM Local
Moto is an Apache 2.0 Python library whose mock_aws decorator fakes AWS calls inside the test process. AWS Emulator’s in-process option, called embedded mode, works with the AWS SDK for Rust. The repo README says a source build needs at least 100 GB of free disk for target/. Embedded mode compiles the emulator into your test binary, so budget disk on the order of that 100 GB for the first cargo test.
Outside embedded mode, the emulator runs as a local Rust server installed from RPM or Debian packages on x86_64 and aarch64 Linux. AWS doesn’t publish a prebuilt image, so on macOS and Windows you build one from the short Dockerfile in the Docker guide. The emulator serves HTTPS on 127.0.0.1 port 9297 and generates fresh SigV4 keys on every start. Idle memory use is about 160 MiB, according to the Linux getting-started guide.
For coding agents that load skills, AWS ships an aws-emulator agent skill that installs with AWS CLI 2.35.0 or later. Your agent can then set up and start the emulator, connect the AWS CLI or SDK and fix certificate or signing errors. The product page says an agent can run the emulator in a sandbox with no network access. Per the same page, nothing the agent creates there reaches your AWS account.
The SAM CLI sam local commands run your Lambda functions on your machine in Lambda-like Docker containers. AWS Emulator also executes function code, which its security page says runs with your user’s permissions and no isolation.
LocalStack’s paid plans include local state persistence and Cloud Pods, and AWS Emulator has neither. AWS Emulator keeps state in memory, has no reset route and deletes all state when it stops.
What to Test Before AWS Emulator Replaces LocalStack in CI
Start by listing the AWS operations your test suite calls. Match those operations against manifest.jsonl in the evaluation suite, then check the scores for your target release. AWS publishes security fixes only in the latest release, according to the versioning page. If a new release changes your test results, the same page says to install a specific version from versions.json. For behavior with no test, run the same workflow against the emulator and against AWS and compare the two results.
If your CI installs the Linux package, start one emulator per job with -p 0, plus --idle-timeout to stop it once idle. Read the port from the startup log line and wait on /__admin/health before the first test. Unset every real AWS credential variable in that job. The SDK setup guide says that without AWS_ENDPOINT_URL in the test shell, your code calls AWS with whatever credentials it finds. Before any test runs, aws sts get-caller-identity should return account 000000000000. Telemetry is on by default, so set EMULATOR_TELEMETRY=off in the job if your security team asks.
Keep a nightly job on real AWS for authorization tests. The emulator doesn’t evaluate IAM policies the way AWS does and never denies a request signed with its own key.
For failure handling, IDC research director Devin Pratt told InfoWorld that the emulator doesn’t simulate throttling or outages. Broadcom senior SRE Advait Patel said that without a 429 or a timeout in your tests, retry and backoff logic “never gets tested.”
If that platform lead runs S3, DynamoDB and SQS suites, I’d move those first. The emulator passes over 80 percent of the tests for each of those services. Lambda passes 48 percent, so I’d keep the Lambda suites where they run now and recheck the scores every few weeks. For whole-app suites, pull your installed version’s scores file from the AWS Emulator releases. Count passing tests for each cross-service prefix that includes your services.
