AWS shipped AWS Emulator on November 11, 2026, a local HTTPS endpoint that answers AWS CLI, SDK, and coding-agent calls without billing a Region. Amazon says autonomous agents wrote every line of the Rust codebase and now maintain it through fidelity tests against real AWS—framed as the fix for agent loops that outrun cloud test budgets.
For builders running Kiro, Claude Code, or other agents on AWS automation benchmarks, the product changes the economics of the verify step: iterate on DynamoDB, S3, SQS, and hundreds of other APIs on a laptop, then promote only passing suites to shared accounts.
TL;DR
| Item | Detail (per AWS, Nov 11, 2026) |
|---|---|
| Coverage | 200+ services from 400+ public API models |
| Endpoint | https://127.0.0.1:9297 (loopback by default) |
| Install | RPM/Deb on Linux; Docker build on macOS/Windows |
| Source | GitHub under CC0 |
| Cost | No emulator fee; pay AWS only on real deploy |
| Maintenance | Agent teams on Bedrock AgentCore + CodePipeline |
| Known gap | IAM policy evaluation not like production AWS |
AWS Emulator local testing endpoint for more than 200 AWS services on a laptop
Image: Amazon Web Services
Why AWS built a first-party emulator now
Coding agents changed the duty cycle of cloud development. An agent can draft infra-as-code, call create-table, put-item, read errors, and patch faster than a human approves a ChangeSet. Doing that loop against real AWS costs money, needs network, and risks cross-test pollution when suites share one account.
AWS already documents agent harnesses through Bedrock AgentCore samples and the pluggable agentic stack. Emulator closes the inner loop: same SigV4-signed requests, same error shapes from Smithy models, but state stays on disk under ~/.aws/emulator/9297/.
Matthew Goldberg's About Amazon post says the idea started as a weekend experiment: one prompt to Kiro produced a passable SQS emulator in about 15 minutes. Scaling that prototype to 200+ services without a multi-year human rewrite is why AWS turned the work over to agent fleets.
AWS Emulator SigV4 local endpoint for coding agents testing cloud APIs
How the local endpoint works
Daniel Abib's launch walkthrough on the AWS News Blog is the authoritative install path.
Start the daemon. On Amazon Linux 2023 you install an RPM from downloads.aws.com, then run aws-emulator. It listens on 127.0.0.1:9297, writes JSON-line logs, and generates fresh TLS, config, and credentials under ~/.aws/emulator/9297/.
Point tools at localhost. Export:
AWS_ENDPOINT_URL=https://127.0.0.1:9297AWS_SHARED_CREDENTIALS_FILEandAWS_CONFIG_FILEto the emulator pathsAWS_EC2_METADATA_DISABLED=trueandAWS_DISABLE_HOST_PREFIX_INJECTION=trueAWS_REGION/AWS_DEFAULT_REGION- Unset
AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY,AWS_SESSION_TOKEN, andAWS_PROFILE
Access keys use the EMULATOR prefix so you cannot accidentally paste them into production pipelines. aws sts get-caller-identity returns account 000000000000 in the walkthrough.
Run unchanged scripts. The post demonstrates aws s3 mb, cp, and ls locally, then a Kiro session that creates a DynamoDB table, writes an item, and reads it back—all without touching a billed account.
Embedded mode for parallel Rust tests
Server mode suits CLI and agents. Embedded mode suits unit tests that need isolation: add the aws-emulator-embedded crate, instantiate AwsEmulatorEmbedded, and wire the SDK HTTP client to the in-process instance. AWS documents a full DynamoDB put/get example in the launch post—each test gets private buckets and tables, so parallel cargo test does not fight over names.
That pattern matters for CI matrices where AgentCore evaluation playbooks spin hundreds of micro-workflows.
Fidelity scores and the public evaluation suite
An emulator is useless if green tests lie. AWS defines fidelity tests: short SDK programs that assert status codes, bodies, error codes, and resource state match real AWS. Each release publishes k of n pass counts per service—for example 40 of 50 tests passing.
The aws-emulator-evaluation-suite repository on GitHub lists every test, including failures, so you can see exact gaps before betting production on a service. Missing operations return HTTP 501 Not Implemented, which fails fast instead of silently succeeding.
IDC analyst Devin Pratt told InfoWorld (quoted in GeekWire's launch recap) that the emulator does not yet simulate throttling, outages, or regional feature skew, and that it does not sandbox executed code. AWS also maintains a public things-that-do-not-work folder—read it before assuming parity on edge cases.
Agent factory: how AWS says it maintains the code
Goldberg and Werner Vogels' All Things Distributed essay describes three agent roles:
- Fidelity authors — craft customer-shaped scenarios, run them against real AWS, file gaps.
- Test runners — execute the suite against the emulator and open issues on mismatch.
- Fixers — one agent per issue, patch code, pass merge gates with adversarial security reviewers.
Hundreds of agents reportedly close thousands of issues per day. Changes flow CodeCommit → CodePipeline → fidelity gate → public GitHub, keeping the CC0 tree aligned with API model updates.
This is the same agent-maintained software narrative AWS pushed in November AgentCore asset drops, but applied to infrastructure simulation instead of sample Lambdas.
Security and IAM: what not to trust
AWS is explicit: do not use the emulator to prove your app is secure. Because IAM and resource policies are not evaluated like production, a deny in AWS might allow locally. Treat the emulator as functional correctness, then run policy tests in a real account with least-privilege agent patterns.
Operational hygiene from the launch post:
- Keep production credentials out of emulator shells.
- Default listener is loopback-only; exposing
9297on a LAN widens blast radius. - Anonymous usage telemetry is on by default; docs describe how to disable it.
Comparison with LocalStack and CloudOpsBench harnesses
LocalStack remains the incumbent open-core emulator. The New Stack notes AWS' CC0 drop and agent maintenance as differentiators, while LocalStack tightened account requirements on its free tier in 2026. Neither replaces the other overnight—check fidelity scores for your service list.
CloudOpsBench (our benchmark write-up) supplies graded ops tasks; its README mentions emulators including Vera as harness options. AWS Emulator is now the vendor-native path for those loops, especially when agents already run inside Kiro or Claude Code on the same machine.
Practical setup checklist for agent teams
| Step | Action |
|---|---|
| 1 | Install package or Docker image per AWS Emulator docs |
| 2 | Export endpoint variables in the same shell the agent uses |
| 3 | Preflight with curl --cacert … /__admin/health and sts get-caller-identity |
| 4 | Pin fidelity scores for services in your IaC |
| 5 | Run security suites on real AWS with scoped credentials |
| 6 | Open GitHub issues when 501 responses block tests you need |
Pair this with Herdr's terminal runtime if you need multi-pane agent sessions while the emulator stays up in a sibling pane.
What developers should watch next
AWS tied the launch to Amazon Bedrock AgentCore tags in the news blog, signaling that agent-written infrastructure tools are now product, not demo. Watch whether fidelity coverage for Bedrock, AgentCore Identity, and registry APIs climbs fast enough for MCP registry automation tests.
Also watch LocalStack and community emulators for multi-account and IAM-heavy scenarios AWS admits are still weak—those gaps are where agents still burn real cloud dollars today.
LocalStack, Vera, and when to keep a cloud sandbox
Teams already standardized on LocalStack should not rip it out overnight. The New Stack's launch recap frames AWS Emulator as first-party, CC0, and agent-maintained, while LocalStack sells Pro features, auth-gated free tiers, and years of community recipes. Your migration trigger should be fidelity scores on the APIs you call, not brand loyalty.
CloudOpsBench and older harness docs mention Vera and other emulators as interchangeable backends. Treat AWS Emulator as another row in that matrix: run the same grader against localhost 9297 before you burn credits in us-east-1.
Keep a dedicated non-prod AWS account anyway. You still need IAM, Organizations, cross-Region failover, and service quotas that no laptop daemon fully models. A sensible pipeline is emulator unit tests → scoped account integration → production change control.
Troubleshooting the first hour
| Symptom | Likely cause | Fix |
|---|---|---|
403 or signature errors | Real AWS keys still exported | unset production variables; use emulator credential file |
| TLS errors in Java SDK | Custom CA not trusted | Add emulator CA to trust store per AWS Java SDK notes |
501 Not Implemented | Gap in service coverage | Check fidelity score; open GitHub issue with failing test |
| Tests pass locally, fail in AWS | IAM or regional behavior | Re-run in real account; emulator skips policy evaluation |
| Slow agent loops | Agent spawns new shell without env | Export variables in agent wrapper or use embedded Rust tests |
Goldberg's posts emphasize EMULATOR-prefixed keys and health checks before suites run. Automate that gate in CI the same way you wait for Postgres containers.
Engineering ethics when agents own the repo
Werner Vogels' essay asks what human senior engineers do when agents write the code. His answer in the November 11 piece: humans design fidelity contracts, merge gates, and threat models; agents execute volume. That matches how explainx.ai covered Amazon's quick agentic primitives taxonomy—define the harness, let automation fill it.
If you contribute issues upstream, remember AWS says it will not take human pull requests for core fixes; agents own the patch queue. Your leverage is clear failing fidelity tests, not drive-by patches.