Noctaxris

README

Run AWS-shaped security labs on your laptop without a cloud bill or a host Docker socket.

docker pull kyaxris/noctaxris:latest
# Container bind is 0.0.0.0; generate unique roots (shipped example pair is refused).
ROOT_AKID="AKIA$(openssl rand -hex 8 | tr '[:lower:]' '[:upper:]')"
ROOT_SECRET="$(openssl rand -hex 32)"
docker run -d --name noctaxris -p 127.0.0.1:4566:4566 \
  -e NOCTAXRIS_LISTEN=0.0.0.0:4566 \
  -e NOCTAXRIS_ALLOW_NONLOOPBACK_LISTEN=1 \
  -e NOCTAXRIS_ROOT_ACCESS_KEY_ID="$ROOT_AKID" \
  -e NOCTAXRIS_ROOT_SECRET_ACCESS_KEY="$ROOT_SECRET" \
  kyaxris/noctaxris:latest
curl http://127.0.0.1:4566/_noctaxris/health
# ok

Point the AWS CLI or SDK at it and call the lab services the same way you would against real AWS.

Go module: github.com/Kyaxris-Labs/Noctaxris. Image tags: latest, semver releases, and nightly from CI.

Why this exists

Lab fidelity	Identity evaluation with boundaries, SCP/RCP filters, PassRole, and condition keys
Secure defaults	Loopback publish only. No host docker.sock. Secrets and CMK material sealed at rest
Nested compute	DinD via Compose noctaxris-engine over TLS. Live Invoke needs a healthy engine. Default engine is restricted (privileged: false + caps/cgroup); use compose.engine-privileged.yaml only if nested smoke fails on your host
CLI-shaped	Latest AWS CLI v2 via --endpoint-url

Quick start

Pull the Hub image, run it on loopback :4566, then hit STS and S3 with the same root keys you passed in.

docker pull kyaxris/noctaxris:latest

# Container bind is 0.0.0.0; generate unique roots (shipped example pair is refused).
ROOT_AKID="AKIA$(openssl rand -hex 8 | tr '[:lower:]' '[:upper:]')"
ROOT_SECRET="$(openssl rand -hex 32)"

docker run -d --name noctaxris -p 127.0.0.1:4566:4566 \
  -e NOCTAXRIS_LISTEN=0.0.0.0:4566 \
  -e NOCTAXRIS_ALLOW_NONLOOPBACK_LISTEN=1 \
  -e NOCTAXRIS_ROOT_ACCESS_KEY_ID="$ROOT_AKID" \
  -e NOCTAXRIS_ROOT_SECRET_ACCESS_KEY="$ROOT_SECRET" \
  kyaxris/noctaxris:latest

curl http://127.0.0.1:4566/_noctaxris/health
curl http://127.0.0.1:4566/_noctaxris/ready

export AWS_ACCESS_KEY_ID="$ROOT_AKID"
export AWS_SECRET_ACCESS_KEY="$ROOT_SECRET"
export AWS_DEFAULT_REGION=us-east-1
EP=http://127.0.0.1:4566

aws configure set default.s3.addressing_style path
aws sts get-caller-identity --endpoint-url "$EP"
aws s3 mb s3://lab-bucket --endpoint-url "$EP"
aws kms create-key --endpoint-url "$EP"

Nested Lambda, ECS, and data engines need Compose with noctaxris-engine. Copy docker/.env.example to docker/.env, replace both root values with unique lab credentials, then docker compose -f docker/compose.yaml --env-file docker/.env up --build. Default host publish is 127.0.0.1:4566 only. Opt-in loopback TCP for selected nested data ports: add -f docker/compose.lab-nested-ports.yaml (see ops.md). Per-service CLI smoke: docs/services/.

Services

Area	Services
Identity	IAM, STS, Organizations, Cognito User Pools
Crypto	KMS
Data	S3, DynamoDB, DynamoDB Streams, SQS, SSM, Secrets Manager, SNS, EventBridge, Scheduler, Pipes, S3 Vectors, RDS, RDS Data API, ElastiCache, MemoryDB, DocumentDB, Neptune
Audit and tags	CloudTrail, GuardDuty, Security Hub, Detective, Macie, VPC Flow Logs (lab; see EC2), CloudWatch Logs, CloudWatch Metrics/Alarms, Resource Groups Tagging API
Streams and delivery	Kinesis, Firehose, Amazon MQ, MSK, Transfer Family, SES, AppConfig, Step Functions
IaC, edge, and governance	CloudFormation, Cloud Control, Glue, WAF v2, Config, ACM, Route 53, Cloud Map, CloudFront, ELB v2, Control Tower (stub)
Compute	Lambda, ECR, ECS, EC2 (lab nested), EKS, CodeBuild, CodeCommit, CodePipeline, CodeDeploy, Batch, AppSync
API edge	API Gateway REST, HTTP API, WebSocket lab lite
Analytics and AI	Athena, OpenSearch, EMR, Bedrock Runtime, Textract, Transcribe
Billing	Pricing, BCM Data Exports, Cost and Usage Reports, Cost Explorer, Budgets
Devices	IoT Core / IoT Data (HTTP shadows + Topic Rules; opt-in MQTT)
Control plane labs	Lightsail, Auto Scaling, Elastic Beanstalk, AWS Backup

Open the service matrix for detailed actions and gaps. Full notes and CLI smoke: docs/services/.

Service matrix (detailed actions / not implemented)

Area	Services	Detailed actions	Not implemented
Identity	IAM	Users, roles, managed and inline policies, managed policy versions (max five), access keys, groups, permissions boundaries, instance profiles (including ListInstanceProfilesForRole), OIDC and SAML IdP CRUD, virtual MFA, GetAccessKeyLastUsed, GenerateCredentialReport / GetCredentialReport (lab CSV).	Out of lab scope: service-linked roles, full pagination and tagging parity. PassRole trust aws:SourceArn on Lambda, EventBridge PutTargets, ECS, Scheduler, Pipes, Secrets rotate, API Gateway CredentialsArn, and Cognito trigger RoleArn.
	STS	All 11 actions (lab MFA on GetSessionToken).	Out of lab scope: deeper AssumeRoot, DecodeAuthorizationMessage, GetDelegatedAccessToken, and GetWebIdentityToken parity.
	Organizations	CreateAccount, ListAccounts, OUs, MoveAccount, EnablePolicyType, SCP and RCP create/attach/detach/describe, ListPolicies / ListPoliciesForTarget / ListParents / ListAccountsForParent. SCP/RCP collection walks account, OU path to root, and root. Identity, boundary, SCP, and RCP apply on shared authorize and dataplane paths.	Out of lab scope: account invites and handshake control-plane beyond MoveAccount.
	Cognito User Pools	Pool and app client CRUD (UpdateUserPool), AdminCreateUser / AdminGetUser / AdminSetUserPassword / AdminDeleteUser / AdminDisableUser / ListUsers / SignUp / ConfirmSignUp / ForgotPassword / ConfirmForgotPassword / ResendConfirmationCode / UpdateUserAttributes / GetUserAttributeVerificationCode / VerifyUserAttribute, InitiateAuth USER_PASSWORD_AUTH / USER_SRP_AUTH (PASSWORD_VERIFIER) / CUSTOM_AUTH (Define/Create/Verify; optional SRP nesting SRP_A → PASSWORD_VERIFIER → CUSTOM_CHALLENGE) plus REFRESH_TOKEN_AUTH / REFRESH_TOKEN with refresh rotation, RevokeToken (unsigned public IdP; Admin* stay SigV4), TOTP MFA (AssociateSoftwareToken / VerifySoftwareToken / RespondToAuthChallenge), lab RoleArn + LambdaConfig with PassRole for cognito-idp.amazonaws.com and sync Invoke of PreSignUp / PostConfirmation / PreAuthentication / PostAuthentication / PreTokenGeneration (V1 ID-token claimsOverrideDetails) / CustomMessage_SignUp / AdminCreateUser / ForgotPassword / ResendCode / UpdateUserAttribute / VerifyUserAttribute (render/store SMS/email body; no SES) / UserMigration_Authentication (password auth) / custom-auth Define/Create/Verify, RS256 ID and access tokens, JWKS on /cognito-idp/REGION/POOL/.well-known/jwks.json.	Out of lab scope: Identity Pools, Hosted UI, SMS/email MFA (CustomMessage_Authentication), Adaptive auth / UI customization. Blocked: UserMigration on USER_SRP_AUTH (AWS requires password auth; SRP obscures the password).
Crypto	KMS	Customer-managed keys, key policies (same-account key-policy-required, cross-account identity and key policy both Allow), Encrypt/Decrypt/GenerateDataKey*/ReEncrypt, RSA_2048 Sign/Verify/GetPublicKey (PEM SPKI; PSS primary), grants, aliases (including lab alias/aws/s3|dynamodb|sqs), ListResourceTags/TagResource/UntagResource and CreateKey Tags, ScheduleKeyDeletion/CancelKeyDeletion (cancel leaves Disabled), on-read sweeper after DeletionDate, key-material rotation (enable rotates sealed material, lab auto-rotate by period).	Out of lab scope: MAC, HMAC/ECC/SM2 specs, asymmetric ENCRYPT_DECRYPT, import, multi-Region, RotateKeyOnDemand API shape, cross-account grant flows, true AWS-owned managed keys. (Resource tags ship: ListResourceTags / TagResource / UntagResource / CreateKey Tags.)
Data	S3	Path-style buckets and objects, bucket policy (same-account identity or policy, cross-account both Allow), SSE-S3/SSE-KMS, presigned GET/PUT, multipart upload (5 MiB min non-final parts), CopyObject (same account), bucket default encryption, versioning lite (Put/GetBucketVersioning, version-aware Get/Put/Delete with delete markers, ListObjectVersions including DeleteMarker), Object Lock lite (CreateBucket ObjectLockEnabled + retain-until; GOVERNANCE bypass header), Put/GetBucketLogging server access logs, Put/Get/DeleteBucketCors, Put/Get/DeleteLifecycleConfiguration (stored; no sweeper), SelectObjectContent lite (CSV/JSON SELECT * FROM s3object [LIMIT n]), Put/GetBucketNotificationConfiguration with emit on Put/Delete/CompleteMultipart to Lambda/SQS/EventBridge/SNS (empty config = off; destination authz re-checked). Get/Delete CloudTrail resources + versionId.	Out of lab scope: website, replication, access points, virtual-hosted style, ACL cross-account, multipart presign, exact AWS notification retry timing, lifecycle expiry sweeper, CORS OPTIONS evaluation, Select WHERE/projection/Parquet/event-stream framing, full Object Lock Legal Hold / COMPLIANCE depth.
	DynamoDB	Tables, item CRUD, Query/Scan with up to two lab GSIs and two lab LSIs, BatchGet/BatchWrite, TransactWriteItems/TransactGetItems (same-account Put/Delete/Update SET/REMOVE/ConditionCheck lab subset with ConditionExpression, ClientRequestToken idempotency, stream append on success, soft cap 25), PartiQL ExecuteStatement/BatchExecuteStatement lite (INSERT/SELECT/UPDATE/DELETE; fail closed on JOIN/nested SELECT), table resource policies (same-account or, cross-account and), CMK encryption, TTL configure and lazy expiry. Stream enablement for DynamoDB Streams lab core.	Out of lab scope: more than two GSIs/LSIs, richer PartiQL, global tables, cross-account / XA transact, live PITR, billing depth.
	DynamoDB Streams	Enable stream on table (NEW_IMAGE, OLD_IMAGE, NEW_AND_OLD_IMAGES, or KEYS_ONLY), ListStreams/DescribeStream, GetShardIterator/GetRecords. Change records on Put/Update/DeleteItem and TransactWrite Put/Delete/Update when enabled. Lambda ESM + FilterCriteria (Keys/NewImage/OldImage) for streams: see Lambda row.	Out of lab scope: global tables, parallel shard fan-out / ParallelizationFactor.
	SQS	Standard and FIFO queues, send/receive/delete (batch and visibility), deduplication, queue policies (same-account or, cross-account and), SSE-SQS and SSE-KMS, RedrivePolicy to DLQ with RedriveAllowPolicy enforcement and lab NoctaxrisDlqSourceArn provenance attribute, DelaySeconds (queue and per-message).	Out of lab scope: high-throughput FIFO quotas, StartMessageMoveTask parity, tags beyond basics.
	SSM / Parameter Store	String, StringList, and SecureString parameters, Put/Get/GetParameters/GetParametersByPath/Delete/Describe, version labels (LabelParameterVersion/GetParameterHistory; Get by Name:version/Name:label or Version/Label), path hierarchy with Recursive, KMS via KeyId or alias/aws/ssm, identity EvaluateFull authz. Run Command lite: SendCommand/GetCommandInvocation/ListCommandInvocations for AWS-RunShellScript on nested DinD EC2 instances (Parameters.commands).	Out of lab scope: parameter policies, UnlabelParameterVersion, full document catalog/sessions/automation, agent message queue, CancelCommand/ListCommands, Output S3, cross-account parameter access.
	Secrets Manager	Create/Get/Put/Delete/Restore/Rotate/Describe/List, resource policies (same-account or, cross-account and), KMS via alias/aws/secretsmanager, recovery window on delete (7-30 days) with on-read sweeper, multi-version stages (AWSCURRENT/AWSPENDING/AWSPREVIOUS, UpdateSecretVersionStage), RotateSecret (random replacement by default; optional RotationLambdaARN with PassRole for secretsmanager.amazonaws.com then four-step createSecret/setSecret/testSecret/finishSecret Invokes), RotationRules (AutomaticallyAfterDays or rate/cron ScheduleExpression with lists/ranges/steps / L / nW / LW / # / DOW+month names + optional Duration in-window jitter) with RotateImmediately=false deferral and in-process due ticker.	Out of lab scope: tags, replication, ListSecrets filtering, random-password APIs, true AWS-owned alias, service-linked grant that skips caller KMS.
	SNS	Topic CRUD including FIFO (.fifo, MessageGroupId/dedup), Publish, Subscribe and Unsubscribe (including XA Subscribe to foreign topic ARNs), List*, Get/SetTopicAttributes, Get/SetSubscriptionAttributes (lab FilterPolicy + RawMessageDelivery + RedrivePolicy DLQ after retry exhaustion), Add/RemovePermission, topic policies (same-account or, cross-account and), confirmed sqs/lambda delivery (destination policy must Allow sns.amazonaws.com; foreign SQS and Lambda ARNs supported) plus loopback HTTP(S) catcher (deny-by-default egress).	Out of lab scope: SMS, email, nested filter-policy operators, HT FIFO quotas, exact AWS retry timing. HTTP(S) beyond the loopback catcher is opt-in only (NOCTAXRIS_SNS_HTTP_EGRESS=1 + allowlist; no open SSRF).
	EventBridge	Default and custom buses, Put/Describe/List/Delete/Enable/Disable Rule, Put/Remove/List Targets (optional DeadLetterConfig), PutPermission/RemovePermission (optional Condition), PutEvents with lab pattern match (source, detail-type, nested detail operators) and bus-policy dual-eval (bus ARN for XA). Targets SQS, Lambda, SNS, Logs, Kinesis, and Step Functions via RoleArn or destination resource policy (events.amazonaws.com + SourceArn; empty policy skips delivery); foreign targets RoleArn AND dest policy. Failed deliveries can send to DeadLetterConfig SQS; outcomes are recorded in lab store delivery history (no public list API). PassRole plus events.amazonaws.com trust on PutTargets RoleArn. Lab InputPath and InputTransformer on delivery.	Out of lab scope: partner buses, archive/replay, API Destinations, legacy scheduled rules, remaining pattern ops (wildcard/$or/cidr), InputPath bracket/wildcard notation, exact retry timing.
	EventBridge Scheduler	Distinct Scheduler API: Create/Get/Update/Delete/ListSchedules. Rate plus cron subset (including DOM nW/LW, L, #, month/DOW names) and optional at(...). Targets Lambda, SQS, SNS, Step Functions. PassRole for scheduler.amazonaws.com. Foreign targets use ARN account I/O and RoleArn plus resource policy AND. In-process ticker.	Out of lab scope: flexible windows, full retry/DLQ matrix, schedule groups depth, universal targets beyond Lambda/SQS/SNS/SFN.
	EventBridge Pipes	Create/Describe/Delete/ListPipes. Source SQS, DynamoDB Streams, or EventBridge bus to target Lambda or SQS. Optional Lambda Enrichment; optional DeadLetterArn on create for enrichment/target failures. PassRole for pipes.amazonaws.com when RoleArn set. Continuous in-process ticker plus PollPipeOnce. Bus sources require RoleArn session Allow on events:PutEvents. RoleArn session or target resource policy on deliver (foreign AND).	Out of lab scope: filter partner matrix, enrichment HTTP/API destinations, cross-account bus source depth beyond RoleArn.
	S3 Vectors	Vector bucket and index CRUD, PutVectors / QueryVectors with in-process cosine or euclidean ranking. Identity authz.	Full condition-key matrix, huge dimensional indexes, metadata filter depth.
	RDS	CreateDBInstance / DescribeDBInstances / DeleteDBInstance for engines postgres, mysql, and mariadb. Nested Postgres (postgres:16-alpine), MySQL (mysql:8.0), or MariaDB (mariadb:11) via DinD data-plane helper when engine is up. Nested-network endpoint only. Master credentials in Secrets Manager.	Out of lab scope: Multi-AZ, read replicas, Aurora full cluster matrix, IAM DB auth tokens, Oracle/SQL Server. Will not ship: host-published DB ports (use RDS Data API on :4566 or nested-network wire protocol).
	RDS Data API	ExecuteStatement and BatchExecuteStatement on :4566 for engines postgres, mysql, and mariadb. Requires resourceArn and secretArn. Postgres prefers pgx (typed OID fields + named parameters) with nested psql fallback. MySQL/MariaDB prefer go-sql-driver/mysql with nested mysql CLI fallback. Real Begin/Commit/Rollback via held wire sessions; otherwise DatabaseUnavailableException (no canned SELECT). formatRecordsAs=JSON; Postgres Batch generatedFields from RETURNING via pgx.	Out of lab scope: ExecuteSql legacy, AWS 3-minute idle (lab 5m), cross-process transaction resume, full MySQL RETURNING/generatedFields parity. Nested wire dial still needs API reachability to the DinD data network.
	ElastiCache	CreateCacheCluster / DescribeCacheClusters / DeleteCacheCluster for redis or valkey. Status creating until nested Valkey/Redis starts; available only with engine. Nested-network endpoint only.	Cluster mode / replication group matrix, Redis AUTH depth, host-published cache ports.
	MemoryDB	CreateCluster / DescribeClusters / DeleteCluster (JSON 1.1 AmazonMemoryDB). Status creating until nested Valkey/Redis starts; available only with engine. Nested-network endpoint only. DescribeUsers / DescribeACLs return empty stubs.	User/ACL create-delete matrix, TLS/IAM auth depth, multi-shard Multi-AZ, host-published MemoryDB ports.
	DocumentDB	CreateDBCluster / DescribeDBClusters / DeleteDBCluster (Engine=docdb). Status creating until nested Mongo-compatible starts; available only with engine. Nested-network endpoint only. Not Neptune.	Change streams, full TLS client auth matrix, host-published document ports.
	Neptune	CreateDBCluster / DescribeDBClusters / DeleteDBCluster (Engine=neptune, SigV4 neptune). Status creating until nested engine starts; available only with engine. Default nested Gremlin {id}.neptune.noctaxris.internal:8182; opt-in Neo4j Bolt :7687 via NOCTAXRIS_NEPTUNE_ENGINE / GraphEngine / tag noctaxris:neptune-engine. Nested-network only.	CreateDBInstance matrix, IAM DB auth, HTTP Gremlin on :4566, host-published Gremlin/Bolt ports.
Audit and tags	CloudTrail	LookupEvents over local cloudtrail/events.jsonl with time and attribute filters (lab SourceIPAddress; account-scoped recipientAccountId; EventCategory=insight for insight-shaped records). CreateTrail/DescribeTrails/DeleteTrail/StartLogging/StopLogging: StartLogging delivers one lab JSONL snapshot to in-account S3 and optional CloudWatch Logs then sets IsLogging; while logging, new JSONL lines ship continuously (AWSLogs hive keys; optional gzip via NOCTAXRIS_CLOUDTRAIL_GZIP; Logs timestamps from eventTime; digest sidecar + lab ValidateLogs). PutEventSelectors/GetEventSelectors lite (management + optional S3 data). Org trail flag (IsOrganizationTrail) on management account. Lab InjectEvents / InjectInsightsEvents when NOCTAXRIS_CLOUDTRAIL_INJECT=1 (no Insights ML engine). Live audit: userName, sessionContext lite, eventCategory/managementEvent, safer requestParameters, resources on key paths, sibling KMS Decrypt audits, service-derived error eventSource; audit XFF via NOCTAXRIS_CLOUDTRAIL_TRUST_XFF=1 only.	Insights ML/anomaly engine and PutInsightSelectors, Lake, full multi-account org-trail delivery matrix, cross-account lookup.
	GuardDuty	CreateDetector/ListDetectors, ListFindings/GetFindings, lab InjectFindings when NOCTAXRIS_GUARDDUTY_INJECT=1 (AWS Finding lite fields).	Detector features matrix, malware protection, attack sequences, finding publishing to Security Hub.
	Security Hub	BatchImportFindings and GetFindings lite (ASFF-lite required fields; filters ProductArn/GeneratorId/SeverityLabel/ResourceType).	Standards, insights, custom actions, full ASFF update rules, Aggregator.
	Detective	CreateGraph/ListGraphs/AcceptInvitation lite; lab SearchGraph joins CloudTrail JSONL and GuardDuty findings by resource ARN or source IP.	Member invitations depth, full entity timeline APIs, attack sequence UI.
	Macie	EnableMacie/GetMacieSession; Create/Describe/ListClassificationJobs (sync COMPLETE); ListFindings/GetFindings; lab InjectFindings when NOCTAXRIS_MACIE_INJECT=1 (Finding lite or canned S3 object pattern matches).	Managed/custom data identifiers, automated discovery, policy findings, ML classification engine.
	VPC Flow Logs (lab)	CreateFlowLogs lite with opaque fl-/vpc-/eni- IDs (no real VPC plane). InjectFlowLogs when NOCTAXRIS_VPCFLOW_INJECT=1 delivers v2 ACCEPT/REJECT lines to S3 or Logs.	Real ENI attachment, traffic mirroring, Transit Gateway flow logs.
	CloudWatch Logs	Create/DeleteLogGroup, Create/DeleteLogStream, DescribeLogGroups/DescribeLogStreams, PutRetentionPolicy/DeleteRetentionPolicy (AWS-allowed day values; expired events purged), PutLogEvents/GetLogEvents, FilterLogEvents (optional stream names, time bounds, lab filterPattern subset: space-AND terms, quoted phrases, ?/* globs, optional -term exclude, JSON { $.path = \"value\" } equality for CT-shaped messages; lab page cap), account Put/Get/Delete/DescribeResourcePolicies, Put/Delete/DescribeSubscriptionFilters to Lambda (awslogs envelope) or lab SQS under destination owner, Put/Delete/DescribeMetricFilters with honest metricFilterCount and store datapoints. Identity EvaluateFull; PassRole on subscription roleArn. Lambda Invoke auto-ships /aws/lambda/* START/END/REPORT.	Out of lab scope: Insights query engine, full CloudWatch filter syntax, Kinesis/Firehose/OpenSearch subscription destinations, full pagination parity.
	CloudWatch Metrics / Alarms	PutMetricData, ListMetrics, GetMetricStatistics, GetMetricData (MetricStat only), PutMetricAlarm, DescribeAlarms, DeleteAlarms, SetAlarmState. JSON via GraniteServiceVersion20100801.* (SigV4 monitoring).	Metric math expressions, composite/anomaly alarms, alarm action fan-out, dashboards, metric streams, smithy-rpc-v2-cbor.
	Resource Groups Tagging API	TagResources, UntagResources, GetResources with TagFilters and ResourceTypeFilters over a lab ARN tag map.	Resource Groups CRUD, GroupBy, tag policy compliance, service-native tag API parity.
Streams and delivery	Kinesis Data Streams	Create/Delete/Describe/ListStreams with ShardCount 1..4, PutRecord/PutRecords (partition-key hash to shard), GetShardIterator/GetRecords per shard, RegisterStreamConsumer/Describe/List/Deregister, SubscribeToShard lab JSON long-poll, UpdateShardCount (UNIFORM_SCALING within 1..4), stream Put/Get/DeleteResourcePolicy. Lambda event source mapping polls all shards sequentially: see Lambda row.	HTTP/2 SubscribeToShard event-stream push, ParallelizationFactor ESM, remapping historical records after scale, encryption depth, Kinesis Data Analytics.
	Firehose	Delivery stream CRUD, PutRecord/PutRecordBatch. S3 destination writes objects. Lambda ARN destination persists records and enqueues async Invoke. OpenSearch destination Create/Put only when the domain is Active with a non-stub nested endpoint (allowlisted hosts; RoleARN + es:ESHttpPut required; skip without engine). Lab VPC Flow Logs destination formats PutRecord payloads as v2 flow lines to S3. Describe returns AmazonopensearchserviceDestinationDescription plus lab OpenSearchDestinationDescription. PassRole for firehose.amazonaws.com; Put evaluates RoleARN session or destination resource policy (S3/Lambda).	HTTP endpoint destinations, dynamic partitioning, OpenSearch domain resource policy, live sync Lambda Invoke from delivery.
	Amazon MQ	CreateBroker/DescribeBroker/ListBrokers/DeleteBroker. RabbitMQ or ActiveMQ nested DinD when engine up (CREATION_IN_PROGRESS→RUNNING, Internal AMQP). No DinD → CREATION_FAILED + stub://. PubliclyAccessible=true rejected. No host/WAN broker ports. Lambda MQ ESM Create when RUNNING (see Lambda row).	Full admin APIs, public broker endpoints. Blocked: ActiveMQ AMQP 1.0/JMS consumer for Lambda ESM (dial-only empty batch).
	MSK	CreateCluster/DescribeCluster/ListClusters/DeleteCluster/GetBootstrapBrokers. Nested Redpanda when DinD up (CREATING→ACTIVE). No DinD → FAILED. Default per-cluster bootstrap noctaxris-msk-<name>:9092; opt-in NOCTAXRIS_SHARED_KAFKA=1 (compose.lab-brokers.yaml) binds one CREATING/ACTIVE cluster process-wide to noctaxris-lab-kafka:9092 (FAILED does not hold the slot; second CREATING/ACTIVE → LimitExceededException; Delete leaves singleton running). No host/WAN Kafka ports.	CreateClusterV2/serverless, TLS/SASL/IAM auth endpoints, multi-broker topology, host-published Kafka ports, multi-tenant shared Kafka.
	Transfer Family	CreateServer/DescribeServer/ListServers/DeleteServer, CreateUser/DescribeUser/ListUsers/DeleteUser, ImportSshPublicKey/DeleteSshPublicKey (SQLite metadata). Servers report ONLINE. Lab file Put/Get/List on /transfer/{serverId}/home/{user}/... or JSON PutFile/GetFile/ListDirectory under the sandbox (path traversal fail-closed) via HTTP on :4566 (same API port; SigV4 service transfer). Omits EndpointType (no VPC theatre); EndpointDetails rejected; PassRole on CreateUser Role. Not a real SFTP listener.	AS2, FTPS depth, IdP integration, WAN expose, live SSH/SFTP listener.
	SES	VerifyEmailIdentity (lab auto-verify), SendEmail/SendRawEmail catcher, ListIdentities, GetSendStatistics stub. SES v2 REST on /v2/email/*: Create/List/Get/DeleteEmailIdentity, POST /v2/email/outbound-emails (Simple/Raw), GetAccount. Shared ses_identities/ses_messages store with v1. No outbound SMTP.	Real relay, receipt rules, configuration sets, templates, suppression, full v2 depth.
	AppConfig	CreateApplication/Environment/ConfigurationProfile, hosted configuration versions, StartDeployment/GetDeployment/ListDeployments (immediate DEPLOYED), GetConfiguration and AppConfigData GetLatestConfiguration return the deployed version pointer.	Deployment strategies, validators, extensions, gradual rollout, feature-flag profile depth.
	Step Functions	Create/Delete/Describe/List state machines, StartExecution/DescribeExecution/GetExecutionHistory. ASL Pass/Succeed/Fail/Choice (String/Numeric Equals/GreaterThan/LessThan, BooleanEquals, IsPresent)/Wait/Parallel/Map and Task to Lambda (sync Invoke), SQS, SNS, or EventBridge bus. Wait Seconds clamped 0–5; Parallel and Map run sequentially in-process (array merge). Top-level InputPath/ResultPath on Pass/Task/Parallel/Map. Task definitions require roleArn. EventBridge and Scheduler can StartExecution with RoleArn; EventBridge may omit RoleArn when a lab state-machine resource policy Allows events.amazonaws.com. PassRole with states.amazonaws.com when RoleArn set. Foreign Task targets AND destination resource policy; PutEvents dual-evals bus policy.	Express workflows, Callback/Activity, Choice And/Or/Not, concurrent Parallel/Map, Timestamp Wait, OutputPath, Map ItemProcessor/distributed mode.
IaC, edge, and governance	CloudFormation	CreateStack/Describe/List/Delete/UpdateStack. ChangeSet Add/Remove plus allowlisted in-place Modify (unknown Modify types or immutable props fail closed). Nested stacks (lab S3 TemplateURL). Drift lite. Types: S3 Bucket(+BucketPolicy, NotificationConfiguration), IAM Role/User/Group/ManagedPolicy/Policy, SQS(+QueuePolicy, create attrs), DynamoDB, Lambda(+Permission with FunctionUrlAuthType), KMS Key/Alias, SNS(+TopicPolicy/Subscription FilterPolicy), Logs LogGroup(+RetentionInDays), Events bus/rule (ScheduleExpression fail-closed), SSM, Secrets, nested Stack. JSON/YAML + DependsOn + Ref/GetAtt/Sub/Join. Unknown types/props fail closed. Optional PassRole.	Out of lab scope: Modify beyond allowlist (including nested Stack), nested drift depth, full intrinsic matrix, broader catalog, custom IAM Path ≠ /, Events Rule ScheduleExpression, Lambda Permission PrincipalOrgID/EventSourceToken. SNS Subscription RedrivePolicy attributes persist; DLQ fan-out follows SNS lab RedrivePolicy (exact AWS retry timing still out of scope).
	Cloud Control	Create/Get/List/Update/Delete + GetResourceRequestStatus for CFN-aligned allowlist (no Stack/QueuePolicy). UpdateResource property-object PatchDocument for documented mutable subsets (including IAM User/Group/ManagedPolicy, EventBus Policy, LogGroup RetentionInDays). Sync ProgressEvent SUCCESS with recorded tokens. Unknown types and unknown patch keys fail closed.	Out of lab scope: RFC6902 PatchDocument, async ProgressEvent polling beyond recorded SUCCESS, private registry types.
	Glue	Data Catalog database and table CRUD over sqlite (Create/Get/GetDatabases/GetTables/Delete*). Tables store PartitionKeys plus StorageDescriptor SerDe/InputFormat fields for Athena. Schema Registry lite: registries/schemas/versions (AVRO/JSON); GetTable resolves empty Columns from SchemaReference. Crawler lite: Create/Start/Get/Delete/ListCrawlers sync-infers CSV/JSON tables from S3 prefixes. Identity authz.	ETL jobs, Lake Formation, partition value registration, nested Spark, Schema Registry PROTOBUF and full compatibility matrix.
	WAF v2	Create/Update/Get/List WebACL, IPSet CRUD, CreateRuleGroup, AssociateWebACL to lab HTTP API / execute-api / AppSync / Lambda function ARNs / ALB loadbalancer/app/... with an invoke gate (REST API, NLB, Cognito rejected), invoke-path DefaultAction gate, ByteMatch on UriPath/SingleHeader (CONTAINS/EXACTLY), SizeConstraint (UriPath/SingleHeader size compare), IPSetReference (ARN or inline CIDR vs SourceIP; unknown ARN fail closed), labeled Evaluate helper. No real edge PoP.	Real PoP / CAPTCHA / Bot Control, full statement catalog, IPSetForwardedIPConfig.
	Config	PutConfigurationRecorder, PutDeliveryChannel (existing S3 bucket), StartConfigurationRecorder writes one lab-shaped JSON snapshot per delivery channel then sets recording (fail closed if PutObject fails) + ConfigurationRecorderStarted SNS, continuous history while recording (S3 bucket create/delete and object PutObject/DeleteObject), GetResourceConfigHistory, DescribeComplianceByConfigRule returns NOT_APPLICABLE. Optional PassRole for config.amazonaws.com.	Full AWS Config item schema, managed rule catalog, remediations, aggregator, organization rules.
	ACM	RequestCertificate/DescribeCertificate/ListCertificates/DeleteCertificate. Lab self-signed PEM via stdlib. No public CA.	Real public CA, live DNS validation propagation, imported cert workflows beyond Put.
	Route 53	CreateHostedZone/DeleteHostedZone/ListHostedZones, ChangeResourceRecordSets/ListResourceRecordSets for A and CNAME, plus Type A AliasTarget to in-account CloudFront DomainName or ELB DNSName (no recursive DNS). Lab InjectQueryLogs to CloudWatch Logs when NOCTAXRIS_ROUTE53_QUERY_LOG_INJECT=1. Identity authz.	AAAA alias, traffic policies, health checks, Resolver endpoints, live recursive DNS.
	Cloud Map	CreatePrivateDnsNamespace (requires lab-opaque Vpc) or HTTP namespace, CreateService, RegisterInstance/DeregisterInstance, DiscoverInstances scoped by Vpc for private DNS.	Full DNS / Route 53 private hosted zones, EC2-validated VPC IDs, health checks depth.
	CloudFront	CreateDistribution/GetDistribution/GetDistributionConfig/UpdateDistribution/ListDistributions/DeleteDistribution plus CreateInvalidation/GetInvalidation/ListInvalidations. GetDistributionConfig returns config + ETag; UpdateDistribution requires IfMatch and mutates Enabled/origins/cache behaviors. Invalidations store paths with Status Completed immediately (no real cache purge). Origins must be existing lab S3 buckets or HTTP API ids. Create returns Deployed plus lab DomainName. Optional DefaultCacheBehavior / CacheBehaviors PathPattern → TargetOriginId (list order; trailing * prefix; * default). Optional Logging bucket/prefix writes tab-separated access-log lite lines on edge GET. SigV4 edge GET /cloudfront/{id}/{key...} selects origin by path pattern (first origin when no behaviors). No real PoP.	Real CDN, signed cookies depth, mid-path wildcards and full cache policy / TTL matrix.
	ELB v2	CreateLoadBalancer/CreateTargetGroup/CreateListener/CreateRule/ModifyListener/ModifyRule/Describe*/Delete*. Type application or network (other values rejected). Target types lambda, ip, or instance (lab-opaque i-*; instance forward when EC2 private IP exists). ALB: HTTP/HTTPS listeners; path-pattern, host-header, http-header, query-string, and source-ip rules; lab listener /alb/{account}/{name}/{port}/... (loopback open dataplane gate). NLB: TCP/TLS listeners; lab HTTP shim /nlb/{account}/{name}/{port}/... to registered ip/instance targets (not true L4). Optional access_logs.s3.* attributes append ALB access-log lite lines to in-account S3. RegisterTargets requires function resolve and elasticloadbalancing.amazonaws.com permission for Lambda. DescribeTargetHealth healthy when a listener or rule forwards (Lambda also needs permission Allows).	ALB Cognito auth action, HTTP-header / query-string conditions, NLB L4 TCP/TLS / UDP, multi-target selection, Gateway LB.
	Control Tower	Honest stub: ListLandingZones returns empty; GetLandingZone returns ResourceNotFoundException (Organizations list APIs cover OU/policy evidence).	Landing zone create/enable, controls catalog, Account Factory.
Compute	Lambda	Zip or Image CreateFunction through UpdateConfiguration, PublishVersion and aliases, layers (max 5, /opt on zip and Image Invoke), sync and async Invoke (Event with SQS DLQ/OnFailure), SQS, DynamoDB Streams, Kinesis, and Amazon MQ event source mappings (MQ Create requires RUNNING nested broker; allowlisted noctaxris-mq-* only; RabbitMQ AMQP 0-9-1 Dial + basic.get on queue noctaxris returns real bodies; ActiveMQ stays dial-then-empty; unit tests may inject MQReceiveFunc), FilterCriteria (EventBridge operators on SQS body / DynamoDB Keys, NewImage, and OldImage / Kinesis data and partitionKey), and ReportBatchItemFailures, Function URLs lite (NONE with CORS * or AllowOrigins allowlist, or AWS_IAM on /lambda-url/...), runtimes python3.11/python3.12/python3.13/python3.14/nodejs20.x/nodejs22.x/nodejs24.x/java21/java25, Invoke qualifiers, AddPermission/GetPolicy/RemovePermission (lab foreign IAM principals and service-principal XA grants with SourceAccount/SourceArn), ImageUri pull of lab ECR 127.0.0.1:4566/ACCOUNT/REPO:tag with Registry V2 auth, PassRole plus lambda.amazonaws.com trust, nested DinD with TLS (no host docker.sock), platform egress deny. Live Invoke requires healthy noctaxris-engine.	Out of lab scope: Enhanced fan-out / ParallelizationFactor Kinesis ESM (stream EFO register/subscribe/UpdateShardCount are under Kinesis), ActiveMQ AMQP 1.0/JMS consumer for MQ ESM (dial-only empty), FilterCriteria $or/wildcard/cidr and FilterCriteria KMS encryption, provisioned concurrency, weighted aliases, Function URL CORS methods/headers depth, EventBridge/Lambda OnFailure destinations, fully rootless nested engine (default is already restricted DinD; privileged opt-in exists), full SAR depth. Will not ship: non-lab private registries (lab ECR on :4566 only).
	ECR	Create/Describe/DeleteRepository, GetAuthorizationToken, repository policies (same-account or, cross-account and), PutImage/BatchGetImage/ListImages/BatchDeleteImage, Registry V2 on 127.0.0.1:4566 with token auth (monolithic PUT and chunked PATCH blob uploads), DinD sync on manifest put for ECS and Lambda Image.	Out of lab scope: scanning, replication, lifecycle, OCI referrers / multi-arch index depth, public galleries, fully rootless nested engine.
	ECS	Register/Describe/List/DeregisterTaskDefinition (requires taskRoleArn and executionRoleArn), RunTask/Describe/List/Stop, CreateService/UpdateService/DeleteService/DescribeServices/ListServices with DesiredCount lab reconciler, DescribeClusters/ListClusters, PassRole plus ecs-tasks.amazonaws.com trust, nested DinD on noctaxris-ecs Internal network (host-gateway ExtraHosts off by default; opt in with NOCTAXRIS_INJECT_ECS_HOST_GATEWAY=1 or docker/compose.lab-ecs-host-gateway.yaml), task-role credential injection. Live RunTask requires healthy noctaxris-engine.	Out of lab scope: load balancers, awsvpc ENI, capacity providers, ECS Exec, Service Connect, autoscaling/circuit breakers/placement/EBS/Firelens, multi-cluster, fully rootless nested engine (default is already restricted DinD; privileged opt-in exists), full SAR depth.
	EC2 (lab nested)	RunInstances / DescribeInstances / DescribeImages / StopInstances / StartInstances / TerminateInstances (Query). Nested keep-alive containers on Internal noctaxris-ec2 via DinD TLS (no host docker.sock). UserData decoded and executed once on create (failures logged; RunInstances still succeeds). IMDS lite sidecar on the same network with ExtraHosts for 169.254.169.254 and AWS_EC2_METADATA_SERVICE_ENDPOINT on port 9255 (no host publish). Lab AMI map (ami-alpine, ami-amazonlinux2023, ami-ubuntu2204); unknown AMI → alpine allowlist pin. Without engine, instances stay pending. VPC/subnet Create/Delete/Describe; security group CRUD plus Authorize/Revoke Ingress/Egress (persisted metadata only; not enforced on DinD); DescribeNetworkInterfaces (synthetic eni-* for instance private IPs) and CreateNetworkInterface stub. VPC Flow CreateFlowLogs / InjectFlowLogs remain under the same ec2 service (see VPC Flow Logs row).	SG/ENI enforcement on nested Docker, SSH, RebootInstances, host port publish / socat.
	EKS	CreateCluster / DescribeCluster / ListClusters / DeleteCluster (REST /clusters). Metadata-only ACTIVE with nested endpoint string https://noctaxris-eks-<name>:6443. Empty ListNodegroups stub. No nested k3s; no live kubectl / CA data.	Nested k3s, kubectl / update-kubeconfig, nodegroups beyond empty list, Fargate profiles, add-ons, access entries.
	CodeBuild	Create/Update/DeleteProject, List/BatchGetProjects, StartBuild, StartBuildBatch, BatchGetBuilds, ListBuilds, StopBuild, Create/Delete/ListWebhooks. Sources NO_SOURCE / S3 / CODECOMMIT; override-lock via source.allowOverride; S3 artifacts (workspace /codebuild/src tar in ZIP when present, else logs-derived); lab IMDS AWS_CONTAINER_CREDENTIALS_FULL_URI on 169.254.170.2:9254; lab webhooks (payloadUrl receive POST /_noctaxris/codebuild/webhook/{account}/{project}). PassRole with codebuild.amazonaws.com. Nested DinD via the shared compute client (no host docker.sock); host-gateway ExtraHosts opt-in like ECS.	Real VPC / fleets / cache / report-group execution (validated config stubs only). GitHub SaaS webhooks.
	CodeCommit	Create/Get/List/DeleteRepository, PutFile, GetFile, GetFolder. Lab filesystem git store under the data root (not git smart-HTTP). CodeBuild CODECOMMIT StartBuild materializes the lab tree into nested builds.	Git smart-HTTP / SSH clone and push, multi-branch refs, merge, pull requests, full CreateCommit / GetCommit / GetDifferences depth.
	CodePipeline	CreatePipeline/GetPipeline/DeletePipeline, StartPipelineExecution, GetPipelineState, Get/ListPipelineExecutions, PutApprovalResult. Manual Approval pauses InProgress until Approved (then CodeBuild) or Rejected. Requires at least one CodeBuild action. Optional PassRole for codepipeline.amazonaws.com.	Full action catalog, cross-region, stop/retry/rollback.
	CodeDeploy	CreateApplication/CreateDeploymentGroup/CreateDeployment/GetDeployment/ListDeployments. Sync Succeeded. Optional PassRole for codedeploy.amazonaws.com. Optional ECS DesiredCount refresh or Lambda PublishVersion when a group stores those targets.	Blue/green traffic shifting, EC2 agent, on-premises instances.
	Batch	CreateComputeEnvironment, CreateJobQueue, RegisterJobDefinition, SubmitJob, Describe*. PassRole for batch.amazonaws.com service role and ecs-tasks.amazonaws.com job role. Nested DinD SubmitJob.	Array/multi-node jobs, fair-share, Fargate/EC2 capacity fidelity.
	AppSync	Create/Get/List/DeleteGraphqlApi, StartSchemaCreation + GetSchemaCreationStatus, ApiKey Create/List/Delete, DataSource and Resolver Create/Update/Get/List/Delete (Lambda + optional serviceRoleArn PassRole), multi-field Query and nested object field resolvers (selection depth ≤ 3), GraphQL POST that Invokes Lambda. Auth API_KEY, AWS_IAM, or AMAZON_COGNITO_USER_POOLS (Bearer JWT via lab Cognito JWKS).	Amplify, subscriptions/MQTT, AppSync JS/VTL runtimes, OIDC beyond Cognito, field arguments/aliases/fragments.
API edge	API Gateway REST API	CreateRestApi/GetRestApi/GetRestApis/DeleteRestApi, CreateResource/GetResources/DeleteResource, PutMethod/GetMethod/DeleteMethod, PutIntegration/GetIntegration (AWS_PROXY Lambda + MOCK), CreateDeployment/CreateStage/GetStage. Method auth NONE, AWS_IAM, or CUSTOM/TOKEN/REQUEST Lambda authorizers. Authorizer CRUD; usage plans and API keys lite with x-api-key when required. Invoke on /restapis/{apiId}/{stage}/_user_request_/{path} (Floci shape).	Authorizer result caching, Cognito user-pool authorizers, usage-plan throttle/quota metering, OpenAPI import/export, method response maps beyond MOCK default. HTTP_PROXY / VPC link default-deny (opt-in allowlist when enabled).
	API Gateway HTTP API / WebSocket	CreateApi/GetApi/UpdateApi/GetApis/DeleteApi, CreateIntegration, GetIntegrations, CreateAuthorizer, GetAuthorizers, CreateRoute, GetRoutes, CreateStage. ProtocolType HTTP or WEBSOCKET. REST /v2/apis... is routed before lab ECR Registry /v2/. Lambda AWS_PROXY; optional opt-in HTTP_PROXY/VPC_LINK with allowlist. Optional CorsConfiguration (HTTP). Route auth NONE, JWT (Cognito JWKS), AWS_IAM (execute-api:Invoke), or CUSTOM REQUEST Lambda authorizer (HTTP). WebSocket routes $connect/$disconnect/$default; lab invoke /ws-api/{apiId}/{stage}/...; PostToConnection on /execute-api/.../@connections/.... HTTP invoke on /http-api/{apiId}/{stage}/{path}.	Out of lab scope: REST TOKEN authorizers, authorizer result caching, custom domains beyond ACM string link, HTTP API resource policies, real ws:// upgrade. Will not ship: open HTTP_PROXY / VPC link without NOCTAXRIS_APIGW_HTTP_PROXY=1 and allowlist.
Analytics and AI	Athena	WorkGroup Create/Get/List/Update/Delete (seeded primary; DISABLED rejects Start; enforce/default OutputLocation). StartQueryExecution / GetQueryExecution / GetQueryResults / StopQueryExecution. In-process SELECT subset over Glue catalog plus lab S3 CSV/JSON, including WHERE equality / != / <> / </>/<=/>= / BETWEEN / IN (...) / LIKE / json_extract lite, COUNT(*), INNER JOIN, GROUP BY + COUNT(*), ORDER BY. Optional nested DuckDB on noctaxris-data (floci/floci-duck-compatible /query, or NOCTAXRIS_DUCKDB_URL) with Glue view injection for Parquet/CSV/JSON; NOCTAXRIS_ATHENA_ENGINE=duckdb\|auto\|inprocess. CloudTrail delivery objects: unwrap Records[], gzip read. Missing S3 location buckets fail closed. Optional ResultConfiguration OutputLocation.	Full SQL without DuckDB (outer joins, NOT IN, multi-aggregate GROUP BY, subqueries), CTAS, federated catalogs, nested Trino/Presto/Spark, in-process Parquet decode; ListQueryExecutions / catalog list APIs.
	OpenSearch	CreateDomain / DescribeDomain / ListDomainNames / DeleteDomain. Nested DinD when engine up (Creating→Active, Internal :9200). Else CreateFailed + stub:// (never Active on stub); lab FailureReason when mmap / memory-lock bootstrap is classified. SigV4 lab query facade PUT/POST /opensearch/{domain}/lab/... (_doc index + allowlisted _search) to nested hosts only. No host search ports.	Full query DSL, fine-grained access control, automatic host sysctl (operator must raise vm.max_map_count for Active).
	EMR	RunJobFlow / DescribeCluster / ListClusters / TerminateJobFlows control-plane stub. AddJobFlowSteps / DescribeStep / ListSteps / CancelSteps (SQLite; immediate COMPLETED, CancelSteps marks CANCELLED). Persist InstanceGroups/Fleets from RunJobFlow; cluster tags; security configs as stored JSON. No host Spark/Hadoop.	Nested Spark engines, EMR Serverless and Studio, AddInstanceGroups/Fleet after create.
	Bedrock Runtime	InvokeModel and Converse over allowlisted modelIds with canned JSON. Unknown modelId fails closed. No real foundation models.	Streaming, Agents, Guardrails, real model runtimes.
	Textract	DetectDocumentText and AnalyzeDocument over Bytes or lab S3Object. Canned PAGE/LINE/WORD Blocks. No real OCR.	Async analysis APIs, Queries/Forms/Tables depth, real OCR.
	Transcribe	StartTranscriptionJob / GetTranscriptionJob / ListTranscriptionJobs. Requires existing lab s3:// media object. Canned transcript under the data root. No real ASR.	Streaming transcription, Call Analytics, writing transcripts into lab S3.
Billing	Pricing	DescribeServices/GetAttributeValues/GetProducts over a tiny static embedded price list. Identity authz.	Live AWS price list sync.
	BCM Data Exports	CreateExport/GetExport/ListExports/DeleteExport. Sample CSV/JSON under the data root. Identity authz.	Scheduled delivery variants beyond sample files.
	Cost and Usage Reports	Put/Modify/Describe/DeleteReportDefinition. Optional CSV PutObject to S3Bucket/S3Prefix; FOCUS lite from S3/Lambda usage enumerators when Format is Parquet/FOCUS or AdditionalSchemaElements includes FOCUS; Format=Parquet stages FOCUS NDJSON then COPY via nested DuckDB (noctaxris-lab-duck / NOCTAXRIS_DUCKDB_URL), fail-closed without engine. Identity authz.	Broader service enumerators, scheduled daily emit.
	Cost Explorer	GetCostAndUsage and GetCostForecast over seeded lab amounts. Identity authz.	Live AWS CE sync, anomaly detection, rightsizing recommendations.
	Budgets	CreateBudget/DescribeBudget/DescribeBudgets/DeleteBudget. SNS subscriber ARNs under NotificationsWithSubscribers receive one lab LAB_CREATE Publish on CreateBudget (not ACTUAL).	Budget actions that mutate accounts, RI/SP coverage, live CE-driven ACTUAL/FORECASTED threshold evaluation.
Devices	IoT Core / Data	Things CRUD; lab CA-signed CreateKeysAndCertificate + cert/policy CRUD; Attach/DetachPolicy; AttachThingPrincipal; Topic Rules (Create/Get/List/Replace/Delete/Enable/Disable; SELECT FROM topic +/# match; SQS/SNS/S3/DDB/Kinesis/Lambda/republish dispatch, missing targets fail closed); HTTP shadows; opt-in MQTT shadow bridge when NOCTAXRIS_SHARED_MQTT=1 (Mosquitto mTLS + IoT policy fail-closed; nested noctaxris-lab-mqtt:1883, API bridge via noctaxris-engine:1883; non-$aws/ publish evaluates rules). Identity authz on HTTP APIs.	Jobs, fleet indexing, operator BYO CA APIs, retained MQTT APIs, WAN ATS hostnames.
Control plane labs	Lightsail	GetBlueprints/GetBundles; instances; disks; static IPs; key pairs; public ports (stored-state only).	Real VMs; container services and managed databases; ImportKeyPair/DownloadDefaultKeyPair.
	Auto Scaling	Launch configuration CRUD; AutoScalingGroup CRUD; SetDesiredCapacity reconciles lab EC2 (Pending without engine; InService when running); ForceDelete terminates members; scaling policies; lifecycle hooks; Attach/Detach/Describe instances (no DinD); ELBv2 target-group attach (ARN validated).	Mixed instances / launch templates; classic ELB attach; CompleteLifecycleAction enforcement; auto-register InService members into attached TGs.
	Elastic Beanstalk	Application/version/environment CRUD lite; TerminateEnvironment; ListAvailableSolutionStacks (Ready/Green store only).	Real platform deploy; configuration settings depth.
	AWS Backup	Vault/plan/selection CRUD; StartBackupJob completes with recovery-point metadata for S3/DDB ARN strings; ListBackupJobs filters; StopBackupJob; DeleteRecoveryPoint.	Real snapshot engine; async job delay.

Defaults

Setting	Value
Listen	127.0.0.1:4566 only
Docker	No host docker.sock (nested noctaxris-engine for Lambda, ECS, CodeBuild, Batch, and nested data engines)
Compute runtime	Nested DinD only (NOCTAXRIS_COMPUTE_RUNTIME unset or dind). Live Lambda/ECS compute needs healthy noctaxris-engine
Data ports	Compose publishes only 127.0.0.1:4566. Nested DataKind ports stay off the host
API replicas	One process per data root. Multi-replica against the same SQLite volume is unsupported and can corrupt state
Credentials	Root keys via env injection
At rest	Secrets and CMK material sealed under the data volume
Authn	SigV4 on AWS API paths except documented open/alternate-auth routes (health, ready, JWKS, federation STS, Function URL NONE, HTTP API NONE, AppSync auth types, optional anonymous S3 GetObject behind NOCTAXRIS_ALLOW_ANONYMOUS_S3)
Function egress	Platform deny on noctaxris-fn (unlike AWS Lambda default internet)

Architecture

Loopback API only. Nested DinD over TLS. No host docker.sock.

flowchart LR
  Client["AWS CLI / SDK"] --> Port["127.0.0.1:4566"]
  Port --> API["noctaxris API"]
  API -->|"TLS"| Engine["noctaxris-engine DinD"]
  Engine --> Nested["Lambda / ECS / nested data"]

Full graph and request path: docs/architecture.md.

Docs

docs/index.md	Architecture, configuration, ops, security posture
docs/services/	Per-service APIs, authz notes, CLI smoke
docs/ops.md	Backup, restore, upgrade, graceful shutdown, CI matrix
docs/release.md	Cutting a release (v1.4.1, Hub latest / semver)
tests/README.md	SDK, Terraform, and CloudFormation suites (Compose required)

Contributors

License

MIT