dozeaws

package module
v0.3.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 18, 2026 License: Apache-2.0 Imports: 19 Imported by: 0

README

doze-aws

Local AWS services, built from scratch in Go. One small static binary that speaks the real AWS wire protocols — no Docker, no JVM, no cloud.

doze-aws
# listening on 127.0.0.1:4566

Point any AWS SDK at it and go:

export AWS_ENDPOINT_URL=http://127.0.0.1:4566
export AWS_ACCESS_KEY_ID=test AWS_SECRET_ACCESS_KEY=test AWS_REGION=us-east-1

aws sts get-caller-identity

What it is

doze-aws emulates the AWS services a development stack leans on, implemented from the wire format up and verified against the real AWS SDKs — both generations (aws-sdk-go v1 and aws-sdk-go-v2 / boto3-era and modern), both signature versions (SigV2 and SigV4), and the legacy Query protocols older clients still speak.

Service Status
STS ✅ complete
SQS ✅ complete — both protocols, FIFO, DLQ redrive, long polling, move tasks, tags
SNS ✅ complete — fanout to SQS/webhooks, filter policies, confirmation handshake
KMS ✅ complete — symmetric + asymmetric (RSA/ECC) + HMAC, real stdlib crypto
SSM Parameter Store ✅ complete — versions, labels, hierarchies, SecureString at-rest encryption
Secrets Manager ✅ complete — version stages, recovery-window deletion, encrypted at rest
S3 ✅ complete — versioning, multipart, full checksum/chunked matrix, CORS, lifecycle, object lock, website
DynamoDB ✅ complete — full expression engine, GSI/LSI, transactions, TTL, paging semantics
EventBridge ✅ complete — full pattern language, SQS/SNS/Lambda targets, input transformers
Lambda ✅ complete — real process runtime (no Docker), versions, function URLs, SQS event source mappings

All 10 services talk to each other: EventBridge→SQS/SNS/Lambda, S3 notifications→SQS/SNS/Lambda, SNS→SQS/Lambda/webhooks, SQS→Lambda.

Per-service operation coverage lives in docs/api-support.

Design ground rules

  • Lightweight above all. Runtime dependencies are bbolt and a TOML parser. Data persists across restarts under one directory you can delete.
  • Real protocols, honest boundaries. Every documented operation of an implemented service gets a handler: functional where locally meaningful, faithful config round-trips where the effect is cloud-infrastructure-only, and a clean error where emulation would be a lie.
  • Embeddable. Each service is a plain Go package exporting an http.Handler (sts.New, sqs.New, ...), and dozeaws.NewStack assembles any subset behind one gateway — the binary is a thin wrapper around exactly that API.
stack, _ := dozeaws.NewStack(dozeaws.StackConfig{DataDir: "./data"})
defer stack.Close()
http.ListenAndServe("127.0.0.1:4566", stack.Handler())

Part of doze

doze-aws is a sibling of doze — the resource-friendly local dev environment — and powers its AWS modules. It works just as happily standalone.

Install

curl -fsSL https://raw.githubusercontent.com/doze-dev/doze-aws/main/install.sh | sh

Or build from source: go build ./cmd/doze-aws (Go 1.26+).

License

Apache 2.0 — see LICENSE.

Documentation

Overview

Package dozeaws assembles the doze-aws services into one embeddable stack: every enabled service constructed over a shared data root, wired to each other in-process, and fronted by the shared-endpoint gateway. This is what the doze-aws binary serves, and what a Go program embeds when it wants all of local AWS behind a single http.Handler: 

stack, err := dozeaws.NewStack(dozeaws.StackConfig{DataDir: "./data"})
defer stack.Close()
http.ListenAndServe("127.0.0.1:4566", stack.Handler())

Programs that want a single service (their own process supervision, custom wiring) skip this package and construct the service directly — every service package (sts, sqs, ...) exports New(Options) returning an http.Handler + io.Closer.

Index

Constants

This section is empty.

Variables

View Source 
var Implemented = []string{"s3", "dynamodb", "sqs", "sns", "sts", "kms", "ssm", "secretsmanager", "eventbridge", "lambda"}

Implemented lists the services this build of doze-aws can serve, in gateway order (currently the full set gateway.Services knows about).

Functions

This section is empty.

Types

type Stack 

type Stack struct {
	// contains filtered or unexported fields
}

Stack is a running set of services behind one gateway.

func NewStack 

func NewStack(cfg StackConfig) (*Stack, error)

NewStack constructs and wires the requested services.

func (*Stack) Close 

func (s *Stack) Close() error

Close shuts every service down, releasing stores and background janitors.

func (*Stack) Handler 

func (s *Stack) Handler() http.Handler

Handler returns the shared-endpoint gateway handler.

func (*Stack) Service 

func (s *Stack) Service(name string) http.Handler

Service returns one service's handler (bypassing gateway routing), or nil if it isn't enabled — useful for mounting a service on its own listener.

type StackConfig 

type StackConfig struct {
	// DataDir is the root under which each service gets its own subdirectory.
	// Required once any stateful service is enabled; the Phase-1 services are
	// stateless and tolerate it empty.
	DataDir string
	// Services to enable; nil enables every implemented service. Unknown or
	// unimplemented names are an error.
	Services []string
	// Logf receives service and gateway log lines; nil discards.
	Logf func(format string, args ...any)
	// S3Host is the host under which virtual-hosted-style S3 bucket addressing
	// is detected (a request to <bucket>.<S3Host> addresses that bucket).
	// Path-style always works.
	S3Host string
	// LambdaIdleTimeout is how long a warm Lambda function keeps its process(es)
	// before scaling to zero. Zero uses the service default (10m).
	LambdaIdleTimeout time.Duration
	// Endpoint is the externally-reachable base URL of this stack's gateway
	// (e.g. "http://127.0.0.1:4566"). It is injected into Lambda function
	// processes as AWS_ENDPOINT_URL so handler code using an AWS SDK reaches
	// sibling services. Leave empty when running fully embedded with no HTTP
	// listener; service-to-service calls still work via in-process peers.
	Endpoint string
}

StackConfig configures a Stack.

Source Files

View all Source files

Directories

Path Synopsis
Package awsident defines the fixed local-AWS identity that every doze-aws service assumes: one region, one account, one set of throwaway credentials.
 Package awsident defines the fixed local-AWS identity that every doze-aws service assumes: one region, one account, one set of throwaway credentials.
cmd
doze-aws command
Command doze-aws serves local, from-scratch emulations of the AWS services a development stack leans on — one shared endpoint, real wire protocols, both AWS SDK generations, no Docker, no JVM.
 Command doze-aws serves local, from-scratch emulations of the AWS services a development stack leans on — one shared endpoint, real wire protocols, both AWS SDK generations, no Docker, no JVM.
Package console is a lightweight, server-rendered web UI for inspecting and managing a doze-aws Stack — an "AWS console, but local and better".
 Package console is a lightweight, server-rendered web UI for inspecting and managing a doze-aws Stack — an "AWS console, but local and better".
Package dynamodb is doze-aws's from-scratch DynamoDB: the full item model (arbitrary-precision numbers, sets, documents), real expression parsing (condition/filter/key-condition/update/projection), GSIs and LSIs maintained transactionally, Query/Scan with DynamoDB's paging semantics, conditional writes, batch operations, single-node TransactWriteItems/TransactGetItems with ClientRequestToken idempotency, and TTL enforced by a janitor.
 Package dynamodb is doze-aws's from-scratch DynamoDB: the full item model (arbitrary-precision numbers, sets, documents), real expression parsing (condition/filter/key-condition/update/projection), GSIs and LSIs maintained transactionally, Query/Scan with DynamoDB's paging semantics, conditional writes, batch operations, single-node TransactWriteItems/TransactGetItems with ClientRequestToken idempotency, and TTL enforced by a janitor.
Package eventbridge is doze-aws's local EventBridge: event buses, rules with the full content-based pattern language (internal/eventpattern), and synchronous delivery to SQS and Lambda targets with Input / InputPath / InputTransformer shaping.
 Package eventbridge is doze-aws's local EventBridge: event buses, rules with the full content-based pattern language (internal/eventpattern), and synchronous delivery to SQS and Lambda targets with Input / InputPath / InputTransformer shaping.
internal
awschunk
Package awschunk decodes the aws-chunked content encoding S3 clients use for streaming uploads.
 Package awschunk decodes the aws-chunked content encoding S3 clients use for streaming uploads.
awshttp
Package awshttp holds the HTTP-level plumbing shared by every doze-aws service: the API error type that stores return for API-visible failures, request-id generation, and the date formats AWS wire protocols use.
 Package awshttp holds the HTTP-level plumbing shared by every doze-aws service: the API error type that stores return for API-visible failures, request-id generation, and the date formats AWS wire protocols use.
awsjson
Package awsjson implements the AWS JSON 1.0/1.1 protocols: POST / with an X-Amz-Target header naming the action ("Prefix.Action"), a JSON body, and JSON responses.
 Package awsjson implements the AWS JSON 1.0/1.1 protocols: POST / with an X-Amz-Target header naming the action ("Prefix.Action"), a JSON body, and JSON responses.
awsquery
Package awsquery implements the AWS Query protocol: form-encoded requests carrying an Action parameter, XML responses in a per-action envelope.
 Package awsquery implements the AWS Query protocol: form-encoded requests carrying an Action parameter, XML responses in a per-action envelope.
checksum
Package checksum implements the flexible-checksum algorithms S3 accepts: CRC32, CRC32C, SHA1, SHA256 from the standard library, and CRC64NVME in-house (Go has no stdlib implementation; it is a ~30-line table-driven CRC with the NVMe polynomial).
 Package checksum implements the flexible-checksum algorithms S3 accepts: CRC32, CRC32C, SHA1, SHA256 from the standard library, and CRC64NVME in-house (Go has no stdlib implementation; it is a ~30-line table-driven CRC with the NVMe polynomial).
config
Package config defines the doze-aws binary's runtime configuration and its defaults.
 Package config defines the doze-aws binary's runtime configuration and its defaults.
ddb/expr
Package expr implements DynamoDB's expression languages — condition, filter, and key-condition expressions (one shared grammar), update expressions, and projection expressions — with a real lexer and recursive-descent parsers.
 Package expr implements DynamoDB's expression languages — condition, filter, and key-condition expressions (one shared grammar), update expressions, and projection expressions — with a real lexer and recursive-descent parsers.
ddb/item
Package item models DynamoDB items: the full AttributeValue type system (S, N, B, BOOL, NULL, M, L, SS, NS, BS) with DynamoDB's semantics — numbers are arbitrary-precision decimals compared numerically (never floats), sets reject duplicates, and item size follows the documented 400 KB accounting.
 Package item models DynamoDB items: the full AttributeValue type system (S, N, B, BOOL, NULL, M, L, SS, NS, BS) with DynamoDB's semantics — numbers are arbitrary-precision decimals compared numerically (never floats), sets reject duplicates, and item size follows the documented 400 KB accounting.
ddb/keyenc
Package keyenc encodes DynamoDB key attribute values (S, N, B) into byte strings whose lexicographic order matches DynamoDB's key order — so bbolt cursors give range queries for free.
 Package keyenc encodes DynamoDB key attribute values (S, N, B) into byte strings whose lexicographic order matches DynamoDB's key order — so bbolt cursors give range queries for free.
ddb/store
Package store is the DynamoDB storage engine: tables and items in bbolt, GSI/LSI entries maintained in the same transaction as every write, range queries via order-preserving key encodings (keyenc), single-node transactions with real atomicity, and TTL enforcement.
 Package store is the DynamoDB storage engine: tables and items in bbolt, GSI/LSI entries maintained in the same transaction as every write, range queries via order-preserving key encodings (keyenc), single-node transactions with real atomicity, and TTL enforcement.
eventpattern
Package eventpattern implements EventBridge's event pattern language: a pattern is a JSON document whose leaves are arrays of conditions; an event matches when every pattern field matches (AND across fields), any condition in a leaf array matches (OR within a field), and arrays in the EVENT match if any element satisfies the condition.
 Package eventpattern implements EventBridge's event pattern language: a pattern is a JSON document whose leaves are arrays of conditions; an event matches when every pattern field matches (AND across fields), any condition in a leaf array matches (OR within a field), and arrays in the EVENT match if any element satisfies the condition.
gateway
Package gateway routes requests arriving on doze-aws's single shared endpoint to the right service, the way AWS SDKs of every generation address a custom endpoint.
 Package gateway routes requests arriving on doze-aws's single shared endpoint to the right service, the way AWS SDKs of every generation address a custom endpoint.
lambdaruntime
Package lambdaruntime runs Lambda functions as supervised local processes that speak the AWS Lambda Runtime API.
 Package lambdaruntime runs Lambda functions as supervised local processes that speak the AWS Lambda Runtime API.
peercall
Package peercall holds the tiny typed clients doze-aws services use to call each other — hand-rolled requests in the target service's own wire format, so aws-sdk-go stays a test-only dependency.
 Package peercall holds the tiny typed clients doze-aws services use to call each other — hand-rolled requests in the target service's own wire format, so aws-sdk-go stays a test-only dependency.
s3store
Package s3store is the storage engine behind the doze-aws s3 service: bucket and object-version metadata in bbolt, object bodies as one file per version on disk.
 Package s3store is the storage engine behind the doze-aws s3 service: bucket and object-version metadata in bbolt, object bodies as one file per version on disk.
schemaver
Package schemaver stamps and verifies a persistence schema version inside each service's bbolt database.
 Package schemaver stamps and verifies a persistence schema version inside each service's bbolt database.
sigparse
Package sigparse extracts identity and routing information from AWS request signatures without ever verifying them.
 Package sigparse extracts identity and routing information from AWS request signatures without ever verifying them.
Package kms is doze-aws's local Key Management Service with real crypto for all three key families:
 Package kms is doze-aws's local Key Management Service with real crypto for all three key families:
Package lambda is doze-aws's local AWS Lambda: functions run as supervised local processes speaking the Lambda Runtime API (no Docker).
 Package lambda is doze-aws's local AWS Lambda: functions run as supervised local processes speaking the Lambda Runtime API (no Docker).
Package peers lets one doze-aws service reach its siblings — SNS delivering to SQS queues, EventBridge dispatching to targets, Lambda destinations — without caring how the deployment is wired.
 Package peers lets one doze-aws service reach its siblings — SNS delivering to SQS queues, EventBridge dispatching to targets, Lambda destinations — without caring how the deployment is wired.
Package s3 is doze-aws's from-scratch S3 service.
 Package s3 is doze-aws's from-scratch S3 service.
Package secretsmanager is doze-aws's local AWS Secrets Manager: secrets with version stages (AWSCURRENT/AWSPREVIOUS plus custom labels), deletion with a recovery window, tags, and resource-policy round-trips.
 Package secretsmanager is doze-aws's local AWS Secrets Manager: secrets with version stages (AWSCURRENT/AWSPREVIOUS plus custom labels), deletion with a recovery window, tags, and resource-policy round-trips.
Package sns is doze-aws's ground-up, pure-Go SNS-compatible service: no LocalStack, no JVM.
 Package sns is doze-aws's ground-up, pure-Go SNS-compatible service: no LocalStack, no JVM.
Package sqs is doze-aws's ground-up, pure-Go SQS-compatible service: no LocalStack, no JVM.
 Package sqs is doze-aws's ground-up, pure-Go SQS-compatible service: no LocalStack, no JVM.
Package ssm is doze-aws's local Systems Manager Parameter Store: parameter hierarchies with versions, labels, and history; String, StringList, and SecureString types.
 Package ssm is doze-aws's local Systems Manager Parameter Store: parameter hierarchies with versions, labels, and history; String, StringList, and SecureString types.
Package stackfile implements doze-aws's declarative resource file: a stack.yaml a team commits to their repo so `doze-aws apply stack.yaml` (or `doze-aws --stack stack.yaml`) stands the whole local stack up.
 Package stackfile implements doze-aws's declarative resource file: a stack.yaml a team commits to their repo so `doze-aws apply stack.yaml` (or `doze-aws --stack stack.yaml`) stands the whole local stack up.
Package sts is doze-aws's local Security Token Service.
 Package sts is doze-aws's local Security Token Service.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.