Noctaxris

README

Run AWS-shaped security labs on your laptop without a cloud bill or a host Docker socket.

docker compose -f docker/compose.yaml --env-file docker/.env up --build
curl http://127.0.0.1:4566/_noctaxris/health
# ok

Point the AWS CLI or SDK at it and call the lab services the same way you would against real AWS.

Go module: github.com/Kyaxris-Labs/Noctaxris. Image tags: latest, semver releases, and nightly from CI.

Why this exists

Lab fidelity	Identity evaluation with boundaries, SCP/RCP filters, PassRole, and condition keys
Secure defaults	Loopback publish only. No host docker.sock. Secrets and CMK material sealed at rest
Nested compute	DinD via Compose noctaxris-engine over TLS. Live Invoke needs a healthy engine. Default engine is restricted (privileged: false + caps/cgroup); use compose.engine-privileged.yaml only if nested smoke fails on your host
CLI-shaped	Latest AWS CLI v2 via --endpoint-url

Quick start

Copy env, bring Compose up, then hit STS and S3 with the same root keys you put in docker/.env.

cp docker/.env.example docker/.env

docker compose -f docker/compose.yaml --env-file docker/.env up --build

curl http://127.0.0.1:4566/_noctaxris/health
curl http://127.0.0.1:4566/_noctaxris/ready

export AWS_ACCESS_KEY_ID=AKIAROOTEXAMPLE01
export AWS_SECRET_ACCESS_KEY='wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'
export AWS_DEFAULT_REGION=us-east-1
EP=http://127.0.0.1:4566

aws configure set default.s3.addressing_style path
aws sts get-caller-identity --endpoint-url "$EP"
aws s3 mb s3://lab-bucket --endpoint-url "$EP"
aws kms create-key --endpoint-url "$EP"

Per-service CLI smoke: docs/services/.

Services

Area	Services
Identity	IAM, STS, Organizations, Cognito User Pools
Crypto	KMS
Data	S3, DynamoDB, DynamoDB Streams, SQS, SSM, Secrets Manager, SNS, EventBridge, Scheduler, Pipes, S3 Vectors, RDS, RDS Data API, ElastiCache, DocumentDB
Audit and tags	CloudTrail, CloudWatch Logs, Resource Groups Tagging API
Streams and delivery	Kinesis, Firehose, Amazon MQ, Transfer Family, SES, AppConfig, Step Functions
IaC, edge, and governance	CloudFormation, Cloud Control, Glue, WAF v2, Config, ACM, Route 53, Cloud Map, CloudFront, ELB v2
Compute	Lambda, ECR, ECS, CodeBuild, CodePipeline, CodeDeploy, Batch, AppSync
API edge	API Gateway HTTP API
Analytics and AI	Athena, OpenSearch, EMR, Bedrock Runtime, Textract, Transcribe
Billing	Pricing, BCM Data Exports, Cost Explorer, Budgets

Expand for detailed actions and gaps. Full notes and CLI smoke: docs/services/.

Service matrix (detailed actions / not implemented)

Area	Services	Detailed actions	Not implemented
Identity	IAM	Users, roles, managed and inline policies, managed policy versions (max five), access keys, groups, permissions boundaries, instance profiles (including ListInstanceProfilesForRole), OIDC and SAML IdP CRUD, virtual MFA.	Out of lab scope: service-linked roles, full pagination and tagging parity. PassRole trust aws:SourceArn on Lambda, EventBridge PutTargets, ECS, Scheduler, Pipes, Secrets rotate, API Gateway CredentialsArn, and Cognito trigger RoleArn.
	STS	All 11 actions (lab MFA on GetSessionToken).	Out of lab scope: deeper AssumeRoot, DecodeAuthorizationMessage, GetDelegatedAccessToken, and GetWebIdentityToken parity.
	Organizations	CreateAccount, ListAccounts, OUs, MoveAccount, EnablePolicyType, SCP and RCP create/attach/detach/describe. SCP/RCP collection walks account, OU path to root, and root. Identity, boundary, SCP, and RCP apply on shared authorize and dataplane paths.	Out of lab scope: account invites and handshake control-plane beyond MoveAccount.
	Cognito User Pools	Pool and app client CRUD (UpdateUserPool), AdminCreateUser / SignUp / ConfirmSignUp, InitiateAuth USER_PASSWORD_AUTH / USER_SRP_AUTH (PASSWORD_VERIFIER) plus REFRESH_TOKEN_AUTH / REFRESH_TOKEN with refresh rotation, RevokeToken (unsigned public IdP; Admin* stay SigV4), TOTP MFA (AssociateSoftwareToken / VerifySoftwareToken / RespondToAuthChallenge), lab RoleArn + LambdaConfig with PassRole for cognito-idp.amazonaws.com and sync Invoke of PreSignUp / PostConfirmation / PreAuthentication / PostAuthentication / PreTokenGeneration, RS256 ID and access tokens, JWKS on /cognito-idp/REGION/POOL/.well-known/jwks.json.	Out of lab scope: Identity Pools, Hosted UI, SMS/email MFA, Adaptive auth / UI customization. Open: PreTokenGeneration claim overrides; UserMigration / custom-auth / CustomMessage Invoke.
Crypto	KMS	Customer-managed keys, key policies (same-account key-policy-required, cross-account identity and key policy both Allow), Encrypt/Decrypt/GenerateDataKey*/ReEncrypt, grants, aliases (including lab alias/aws/s3|dynamodb|sqs), ListResourceTags/TagResource/UntagResource and CreateKey Tags, ScheduleKeyDeletion/CancelKeyDeletion (cancel leaves Disabled), on-read sweeper after DeletionDate, key-material rotation (enable rotates sealed material, lab auto-rotate by period).	Out of lab scope: Sign/Verify, MAC, asymmetric/HMAC specs, import, multi-Region, RotateKeyOnDemand API shape, cross-account grant flows, true AWS-owned managed keys. (Resource tags ship: ListResourceTags / TagResource / UntagResource / CreateKey Tags.)
Data	S3	Path-style buckets and objects, bucket policy (same-account identity or policy, cross-account both Allow), SSE-S3/SSE-KMS, presigned GET/PUT, multipart upload (5 MiB min non-final parts), CopyObject (same account), bucket default encryption, versioning lite (Put/GetBucketVersioning, version-aware Get/Put, ListObjectVersions lite), Put/GetBucketNotificationConfiguration with emit on Put/Delete/CompleteMultipart to Lambda/SQS/EventBridge/SNS (empty config = off; destination authz re-checked).	Out of lab scope: lifecycle, CORS/website, Object Lock, replication, access points, virtual-hosted style, ACL cross-account, delete markers depth, multipart presign, exact AWS notification retry timing.
	DynamoDB	Tables, item CRUD, Query/Scan with up to two lab GSIs, BatchGet/BatchWrite, TransactWriteItems/TransactGetItems (same-account Put/Delete/Update SET/REMOVE/ConditionCheck lab subset with ConditionExpression, ClientRequestToken idempotency, stream append on success, soft cap 25), table resource policies (same-account or, cross-account and), CMK encryption, TTL configure and lazy expiry. Stream enablement for DynamoDB Streams lab core.	Out of lab scope: more than two GSIs, LSI, PartiQL, global tables, cross-account / XA transact, live PITR, billing depth.
	DynamoDB Streams	Enable stream on table (NEW_IMAGE, OLD_IMAGE, NEW_AND_OLD_IMAGES, or KEYS_ONLY), ListStreams/DescribeStream, GetShardIterator/GetRecords. Change records on Put/Update/DeleteItem and TransactWrite Put/Delete/Update when enabled. Lambda ESM + FilterCriteria (Keys/NewImage/OldImage) for streams: see Lambda row.	Out of lab scope: global tables, parallel shard fan-out / ParallelizationFactor.
	SQS	Standard and FIFO queues, send/receive/delete (batch and visibility), deduplication, queue policies (same-account or, cross-account and), SSE-SQS and SSE-KMS, RedrivePolicy to DLQ with RedriveAllowPolicy enforcement, DelaySeconds (queue and per-message).	Out of lab scope: high-throughput FIFO quotas, StartMessageMoveTask parity, tags beyond basics.
	SSM Parameter Store	String, StringList, and SecureString parameters, Put/Get/GetParameters/GetParametersByPath/Delete/Describe, path hierarchy with Recursive, KMS via KeyId or alias/aws/ssm, identity EvaluateFull authz.	Out of lab scope: parameter policies, labels, tags, documents/sessions/automation, full pagination parity, cross-account parameter access.
	Secrets Manager	Create/Get/Put/Delete/Restore/Rotate/Describe/List, resource policies (same-account or, cross-account and), KMS via alias/aws/secretsmanager, recovery window on delete (7-30 days) with on-read sweeper, multi-version stages (AWSCURRENT/AWSPENDING/AWSPREVIOUS, UpdateSecretVersionStage), RotateSecret (random replacement by default; optional RotationLambdaARN with PassRole for secretsmanager.amazonaws.com then four-step createSecret/setSecret/testSecret/finishSecret Invokes), RotationRules (AutomaticallyAfterDays or rate/cron ScheduleExpression + optional Duration) with RotateImmediately=false deferral and in-process due ticker.	Open: Secrets cron wildcards beyond lab digit/*/?; random rotate time inside Duration window. Out of lab scope: tags, replication, ListSecrets filtering, random-password APIs, true AWS-owned alias, service-linked grant that skips caller KMS.
	SNS	Topic CRUD including FIFO (.fifo, MessageGroupId/dedup), Publish, Subscribe and Unsubscribe (including XA Subscribe to foreign topic ARNs), List*, Get/SetTopicAttributes, Get/SetSubscriptionAttributes (lab FilterPolicy + RawMessageDelivery), Add/RemovePermission, topic policies (same-account or, cross-account and), confirmed sqs/lambda delivery (destination policy must Allow sns.amazonaws.com; foreign SQS and Lambda ARNs supported) plus loopback HTTP(S) catcher (deny-by-default egress).	Out of lab scope: SMS, email, nested filter-policy operators, RedrivePolicy DLQ delivery, HT FIFO quotas, exact AWS retry timing. Will not ship: open-internet HTTP(S) webhooks (loopback catcher only).
	EventBridge	Default and custom buses, Put/Describe/List/Delete/Enable/Disable Rule, Put/Remove/List Targets, PutPermission/RemovePermission (optional Condition), PutEvents with lab pattern match (source, detail-type, nested detail operators) and bus-policy dual-eval (bus ARN for XA). Targets SQS, Lambda, SNS, Logs, Kinesis, and Step Functions via RoleArn or destination resource policy (events.amazonaws.com + SourceArn; empty policy skips delivery); foreign targets RoleArn AND dest policy. PassRole plus events.amazonaws.com trust on PutTargets RoleArn. Lab InputPath and InputTransformer on delivery.	Out of lab scope: partner buses, archive/replay, API Destinations, legacy scheduled rules, remaining pattern ops (wildcard/$or/cidr), InputPath bracket/wildcard notation, exact retry timing.
	EventBridge Scheduler	Distinct Scheduler API: Create/Get/Update/Delete/ListSchedules. Rate plus small cron subset and optional at(...). Targets Lambda, SQS, SNS, Step Functions. PassRole for scheduler.amazonaws.com. Foreign targets use ARN account I/O and RoleArn plus resource policy AND. In-process ticker.	Out of lab scope: flexible windows, full retry/DLQ matrix, schedule groups depth, universal targets beyond Lambda/SQS/SNS/SFN.
	EventBridge Pipes	Create/Describe/Delete/ListPipes. Source SQS, DynamoDB Streams, or EventBridge bus to target Lambda or SQS. Optional Lambda Enrichment. PassRole for pipes.amazonaws.com when RoleArn set. Continuous in-process ticker plus PollPipeOnce. Bus sources require RoleArn session Allow on events:PutEvents. RoleArn session or target resource policy on deliver (foreign AND).	Out of lab scope: filter partner matrix, enrichment HTTP/API destinations, cross-account bus source depth beyond RoleArn.
	S3 Vectors	Vector bucket and index CRUD, PutVectors / QueryVectors with in-process cosine or euclidean ranking. Identity authz.	Full condition-key matrix, huge dimensional indexes, metadata filter depth.
	RDS	CreateDBInstance / DescribeDBInstances / DeleteDBInstance for engine postgres. Nested Postgres via DinD data-plane helper when engine is up. Nested-network endpoint only. Master credentials in Secrets Manager.	Out of lab scope: MySQL, Multi-AZ, read replicas, Aurora full cluster matrix, IAM DB auth tokens. Will not ship: host-published Postgres ports (Data API on :4566 only).
	RDS Data API	ExecuteStatement and BatchExecuteStatement on :4566. Requires resourceArn and secretArn. Prefers pgx against the nested data-plane DSN (typed OID fields + named parameters); falls back to nested psql when the wire dial fails. Real Begin/Commit/Rollback via held pgx sessions (txn-scoped Execute/Batch); otherwise DatabaseUnavailableException (no canned SELECT). formatRecordsAs=JSON; Batch generatedFields from RETURNING via pgx.	Out of lab scope: ExecuteSql legacy, AWS 3-minute idle (lab 5m), cross-process transaction resume. Nested pgx dial still needs API reachability to the DinD data network.
	ElastiCache	CreateCacheCluster / DescribeCacheClusters / DeleteCacheCluster for redis or valkey. Status creating until nested Valkey/Redis starts; available only with engine. Nested-network endpoint only.	Cluster mode / replication group matrix, Redis AUTH depth, MemoryDB, host-published cache ports.
	DocumentDB	CreateDBCluster / DescribeDBClusters / DeleteDBCluster (Engine=docdb). Status creating until nested Mongo-compatible starts; available only with engine. Nested-network endpoint only. Not Neptune.	Neptune, change streams, full TLS client auth matrix, host-published document ports.
Audit and tags	CloudTrail	LookupEvents over local cloudtrail/events.jsonl with time and attribute filters.	CreateTrail, selectors, Insights, Lake, delivery to S3 or Logs, cross-account lookup.
	CloudWatch Logs	Create/DeleteLogGroup, Create/DeleteLogStream, DescribeLogGroups/DescribeLogStreams, PutRetentionPolicy/DeleteRetentionPolicy (AWS-allowed day values; expired events purged), PutLogEvents/GetLogEvents, FilterLogEvents (optional stream names, time bounds, lab filterPattern subset: space-AND terms, quoted phrases, ?/* globs, optional -term exclude; lab page cap), account Put/Get/Delete/DescribeResourcePolicies, Put/Delete/DescribeSubscriptionFilters to Lambda (awslogs envelope) or lab SQS under destination owner, Put/Delete/DescribeMetricFilters with honest metricFilterCount and store datapoints. Identity EvaluateFull; PassRole on subscription roleArn.	Out of lab scope: Insights query engine, full CloudWatch filter syntax, full Metrics/Alarms API, Kinesis/Firehose/OpenSearch subscription destinations, full pagination parity.
	Resource Groups Tagging API	TagResources, UntagResources, GetResources with TagFilters and ResourceTypeFilters over a lab ARN tag map.	Resource Groups CRUD, GroupBy, tag policy compliance, service-native tag API parity.
Streams and delivery	Kinesis Data Streams	Create/Delete/Describe/ListStreams with ShardCount 1..4, PutRecord/PutRecords (partition-key hash to shard), GetShardIterator/GetRecords per shard, stream Put/Get/DeleteResourcePolicy. Lambda event source mapping polls all shards sequentially: see Lambda row.	Shard split/merge APIs, enhanced fan-out, encryption depth, Kinesis Data Analytics.
	Firehose	Delivery stream CRUD, PutRecord/PutRecordBatch. S3 destination writes objects. Lambda ARN destination persists records and enqueues async Invoke. PassRole for firehose.amazonaws.com; Put evaluates RoleARN session or destination resource policy.	OpenSearch/HTTP destinations, dynamic partitioning, live Lambda Invoke from delivery.
	Amazon MQ	CreateBroker/DescribeBroker/ListBrokers/DeleteBroker. RabbitMQ nested DinD when engine up (CREATION_IN_PROGRESS→RUNNING, Internal AMQP). ActiveMQ or no DinD → CREATION_FAILED + stub://. PubliclyAccessible=true rejected. No host/WAN broker ports.	Nested ActiveMQ, MSK/Kafka, full admin APIs, public broker endpoints.
	Transfer Family	CreateServer/DescribeServer/ListServers/DeleteServer, CreateUser/DeleteUser. SFTP-shaped sandbox under the data root. Describe reports OFFLINE and omits EndpointType (no VPC theatre); EndpointDetails rejected; PassRole on CreateUser Role.	AS2, FTPS depth, IdP integration, WAN expose, live SFTP listener.
	SES	VerifyEmailIdentity (lab auto-verify), SendEmail/SendRawEmail catcher, ListIdentities, GetSendStatistics stub. No outbound SMTP.	Real relay, receipt rules, configuration sets, SES v2 depth.
	AppConfig	CreateApplication/Environment/ConfigurationProfile, hosted configuration versions, GetConfiguration, AppConfigData StartConfigurationSession/GetLatestConfiguration.	Deployment strategies, validators, extensions, feature-flag profile depth.
	Step Functions	Create/Delete/Describe/List state machines, StartExecution/DescribeExecution/GetExecutionHistory. ASL Pass/Succeed/Fail and Task to Lambda (sync Invoke), SQS, SNS, or EventBridge bus. Task definitions require roleArn. EventBridge and Scheduler can StartExecution with RoleArn; EventBridge may omit RoleArn when a lab state-machine resource policy Allows events.amazonaws.com. PassRole with states.amazonaws.com when RoleArn set. Foreign Task targets AND destination resource policy; PutEvents dual-evals bus policy.	Choice/Wait/Parallel/Map, Express workflows, InputPath/ResultPath depth.
IaC, edge, and governance	CloudFormation	CreateStack/Describe/List/Delete/UpdateStack. ChangeSet Add/Remove plus allowlisted in-place Modify (unknown Modify types or immutable props fail closed). Nested stacks (lab S3 TemplateURL). Drift lite. Types: S3 Bucket(+BucketPolicy, NotificationConfiguration), IAM Role/User/Group/ManagedPolicy/Policy, SQS(+QueuePolicy, create attrs), DynamoDB, Lambda(+Permission with FunctionUrlAuthType), KMS Key/Alias, SNS(+TopicPolicy/Subscription FilterPolicy), Logs LogGroup(+RetentionInDays), Events bus/rule (ScheduleExpression fail-closed), SSM, Secrets, nested Stack. JSON/YAML + DependsOn + Ref/GetAtt/Sub/Join. Unknown types/props fail closed. Optional PassRole.	Out of lab scope: Modify beyond allowlist (including nested Stack), nested drift depth, full intrinsic matrix, broader catalog, custom IAM Path ≠ /, Events Rule ScheduleExpression, Lambda Permission PrincipalOrgID/EventSourceToken, SNS RedrivePolicy DLQ delivery.
	Cloud Control	Create/Get/List/Update/Delete + GetResourceRequestStatus for CFN-aligned allowlist (no Stack/QueuePolicy). UpdateResource property-object PatchDocument for documented mutable subsets (including IAM User/Group/ManagedPolicy, EventBus Policy, LogGroup RetentionInDays). Sync ProgressEvent SUCCESS with recorded tokens. Unknown types and unknown patch keys fail closed.	Out of lab scope: RFC6902 PatchDocument, async ProgressEvent polling beyond recorded SUCCESS, private registry types.
	Glue	Data Catalog database and table CRUD over sqlite (Create/Get/GetDatabases/GetTables/Delete*). Tables store PartitionKeys plus StorageDescriptor SerDe/InputFormat fields for Athena. Identity authz.	Crawlers, ETL jobs, Lake Formation, partition value registration.
	WAF v2	Create/Update/Get/List WebACL, CreateRuleGroup, AssociateWebACL to lab HTTP API / execute-api / AppSync / Lambda function ARNs with an invoke gate (ALB / REST / Cognito rejected), invoke-path DefaultAction gate, labeled Evaluate helper. No real edge PoP.	Real PoP / CAPTCHA / Bot Control, full statement catalog.
	Config	PutConfigurationRecorder, PutDeliveryChannel (existing S3 bucket), StartConfigurationRecorder (recording flag + ConfigurationRecorderStarted SNS; no history PutObject), DescribeComplianceByConfigRule returns NOT_APPLICABLE. Optional PassRole for config.amazonaws.com.	Configuration history to S3, managed rule catalog, remediations, aggregator, organization rules.
	ACM	RequestCertificate/DescribeCertificate/ListCertificates/DeleteCertificate. Lab self-signed PEM via stdlib. No public CA.	Real public CA, live DNS validation propagation, imported cert workflows beyond Put.
	Route 53	CreateHostedZone/DeleteHostedZone/ListHostedZones, ChangeResourceRecordSets/ListResourceRecordSets for A and CNAME. Identity authz.	Alias targets to CloudFront/ELB, traffic policies, Resolver endpoints.
	Cloud Map	CreatePrivateDnsNamespace (requires lab-opaque Vpc) or HTTP namespace, CreateService, RegisterInstance/DeregisterInstance, DiscoverInstances scoped by Vpc for private DNS.	Full DNS / Route 53 private hosted zones, EC2-validated VPC IDs, health checks depth.
	CloudFront	CreateDistribution/GetDistribution/ListDistributions/DeleteDistribution control-plane stub. Origins must be existing lab S3 buckets or HTTP API ids. Status InProgress; DomainName omitted. No real PoP.	Fake-edge DomainName/Deployed, real CDN, signed cookies depth, multi-behavior matrices.
	ELB v2	CreateLoadBalancer/CreateTargetGroup/CreateListener/Describe*/Delete*. Type application only (network rejected). Target types lambda or ip. RegisterTargets requires function resolve and elasticloadbalancing.amazonaws.com permission. Lab listener /alb/{account}/{name}/{port}/... invokes Lambda (loopback open dataplane gate). DescribeTargetHealth healthy when a listener forwards and permission Allows; IP stays unused. No EC2.	ALB Cognito auth action, path routing depth, IP target dataplane, NLB.
Compute	Lambda	Zip or Image CreateFunction through UpdateConfiguration, PublishVersion and aliases, layers (max 5, /opt on zip and Image Invoke), sync and async Invoke (Event with SQS DLQ/OnFailure), SQS, DynamoDB Streams, and Kinesis event source mappings (in-process poller walks all stream shards sequentially), FilterCriteria (EventBridge operators on SQS body / DynamoDB Keys, NewImage, and OldImage / Kinesis data and partitionKey), and ReportBatchItemFailures, Function URLs lite (NONE with CORS * or AllowOrigins allowlist, or AWS_IAM on /lambda-url/...), runtimes python3.11/python3.12/nodejs20.x, Invoke qualifiers, AddPermission/GetPolicy/RemovePermission (lab foreign IAM principals and service-principal XA grants with SourceAccount/SourceArn), ImageUri pull of lab ECR 127.0.0.1:4566/ACCOUNT/REPO:tag with Registry V2 auth, PassRole plus lambda.amazonaws.com trust, nested DinD with TLS (no host docker.sock), platform egress deny. Live Invoke requires healthy noctaxris-engine.	Out of lab scope: Enhanced fan-out / ParallelizationFactor Kinesis ESM, MQ ESM sources, FilterCriteria $or/wildcard/cidr and FilterCriteria KMS encryption, provisioned concurrency, weighted aliases, Function URL CORS methods/headers depth, EventBridge/Lambda OnFailure destinations, fully rootless nested engine (default is already restricted DinD; privileged opt-in exists), full SAR depth. Will not ship: non-lab private registries (lab ECR on :4566 only).
	ECR	Create/Describe/DeleteRepository, GetAuthorizationToken, repository policies (same-account or, cross-account and), PutImage/BatchGetImage/ListImages/BatchDeleteImage, Registry V2 on 127.0.0.1:4566 with token auth (monolithic PUT and chunked PATCH blob uploads), DinD sync on manifest put for ECS and Lambda Image.	Out of lab scope: scanning, replication, lifecycle, OCI referrers / multi-arch index depth, public galleries, fully rootless nested engine.
	ECS	Register/Describe/List/DeregisterTaskDefinition (requires taskRoleArn and executionRoleArn), RunTask/Describe/List/Stop, CreateService/UpdateService/DeleteService/DescribeServices/ListServices with DesiredCount lab reconciler, DescribeClusters/ListClusters, PassRole plus ecs-tasks.amazonaws.com trust, nested DinD on noctaxris-ecs Internal network, task-role credential injection. Live RunTask requires healthy noctaxris-engine.	Out of lab scope: load balancers, awsvpc ENI, capacity providers, ECS Exec, Service Connect, autoscaling/circuit breakers/placement/EBS/Firelens, multi-cluster, fully rootless nested engine (default is already restricted DinD; privileged opt-in exists), full SAR depth.
	CodeBuild	CreateProject, StartBuild, BatchGetBuilds, ListBuilds. Inline or S3 buildspec. PassRole with codebuild.amazonaws.com. Nested DinD via the shared compute client (no host docker.sock).	VPC, fleets, CodeCommit, batch build matrix, artifact publishing depth.
	CodePipeline	CreatePipeline/GetPipeline/DeletePipeline, StartPipelineExecution, GetPipelineState. Requires at least one CodeBuild action. StartPipelineExecution calls nested CodeBuild StartBuild for each ProjectName. Optional PassRole for codepipeline.amazonaws.com.	Full action catalog, approvals, cross-region.
	CodeDeploy	CreateApplication/CreateDeploymentGroup/CreateDeployment/GetDeployment/ListDeployments. Sync Succeeded. Optional PassRole for codedeploy.amazonaws.com. Optional ECS DesiredCount refresh or Lambda PublishVersion when a group stores those targets.	Blue/green traffic shifting, EC2 agent, on-premises instances.
	Batch	CreateComputeEnvironment, CreateJobQueue, RegisterJobDefinition, SubmitJob, Describe*. PassRole for batch.amazonaws.com service role and ecs-tasks.amazonaws.com job role. Nested DinD SubmitJob.	Array/multi-node jobs, fair-share, Fargate/EC2 capacity fidelity.
	AppSync	Create/Get/List/DeleteGraphqlApi, schema store, CreateApiKey, Lambda data source plus one Query resolver, GraphQL POST that Invokes Lambda. Auth API_KEY, AWS_IAM, or AMAZON_COGNITO_USER_POOLS (Bearer JWT via lab Cognito JWKS).	Amplify, subscriptions/MQTT, full GraphQL spec, AppSync JS/VTL runtimes, OIDC beyond Cognito.
API edge	API Gateway HTTP API	CreateApi/GetApi/UpdateApi/GetApis/DeleteApi, CreateIntegration, GetIntegrations, CreateAuthorizer, GetAuthorizers, CreateRoute, GetRoutes, CreateStage. REST /v2/apis... is routed before lab ECR Registry /v2/. Lambda AWS_PROXY only. Optional CorsConfiguration (origins/methods/headers/MaxAge/credentials; OPTIONS preflight without an OPTIONS route). Route auth NONE, JWT (Cognito JWKS), AWS_IAM (execute-api:Invoke), or CUSTOM REQUEST Lambda authorizer (simple isAuthorized / IAM policy; Deny short-circuits before integration). Optional CredentialsArn PassRole for apigateway.amazonaws.com. Invoke on /http-api/{apiId}/{stage}/{path}.	Out of lab scope: REST API v1, WebSocket, REST TOKEN authorizers, authorizer result caching, custom domains beyond ACM string link, HTTP API resource policies. Will not ship: HTTP_PROXY / VPC link integrations.
Analytics and AI	Athena	StartQueryExecution / GetQueryExecution / GetQueryResults / StopQueryExecution. In-process SELECT subset over Glue catalog plus lab S3 CSV/JSON. Missing S3 location buckets fail closed. Optional ResultConfiguration OutputLocation.	Full SQL, CTAS, federated catalogs, nested Trino/Presto/Spark.
	OpenSearch	CreateDomain / DescribeDomain / ListDomainNames / DeleteDomain. Nested DinD when engine up (Creating→Active, Internal :9200). Else CreateFailed + stub:// (never Active on stub); lab FailureReason when mmap / memory-lock bootstrap is classified. No host search ports.	Query-plane index/search, full query DSL proxy, fine-grained access control, automatic host sysctl (operator must raise vm.max_map_count for Active).
	EMR	RunJobFlow / DescribeCluster / ListClusters / TerminateJobFlows control-plane stub. No host Spark/Hadoop.	Full step matrix, nested Spark engines, EMR Serverless and Studio.
	Bedrock Runtime	InvokeModel over allowlisted modelIds with canned JSON. Unknown modelId fails closed. No real foundation models.	Converse, streaming, Agents, Guardrails, real model runtimes.
	Textract	DetectDocumentText and AnalyzeDocument over Bytes or lab S3Object. Canned PAGE/LINE/WORD Blocks. No real OCR.	Async analysis APIs, Queries/Forms/Tables depth, real OCR.
	Transcribe	StartTranscriptionJob / GetTranscriptionJob / ListTranscriptionJobs. Requires existing lab s3:// media object. Canned transcript under the data root. No real ASR.	Streaming transcription, Call Analytics, writing transcripts into lab S3.
Billing	Pricing	DescribeServices/GetAttributeValues/GetProducts over a tiny static embedded price list. Identity authz.	Live AWS price list sync.
	BCM Data Exports	CreateExport/GetExport/ListExports/DeleteExport. Sample CSV/JSON under the data root. Identity authz.	Scheduled CUR delivery to S3, Parquet variants.
	Cost Explorer	GetCostAndUsage and GetCostForecast over seeded lab amounts. Identity authz.	Live AWS CE sync, anomaly detection, rightsizing recommendations.
	Budgets	CreateBudget/DescribeBudget/DescribeBudgets/DeleteBudget. SNS subscriber ARNs under NotificationsWithSubscribers receive one lab LAB_CREATE Publish on CreateBudget (not ACTUAL).	Budget actions that mutate accounts, RI/SP coverage, live CE-driven ACTUAL/FORECASTED threshold evaluation.

Defaults

Setting	Value
Listen	127.0.0.1:4566 only
Docker	No host docker.sock (nested noctaxris-engine for Lambda, ECS, CodeBuild, Batch, and nested data engines)
Compute runtime	Nested DinD only (NOCTAXRIS_COMPUTE_RUNTIME unset or dind). Live Lambda/ECS compute needs healthy noctaxris-engine
Data ports	Compose publishes only 127.0.0.1:4566. Nested DataKind ports stay off the host
API replicas	One process per data root. Multi-replica against the same SQLite volume is unsupported and can corrupt state
Credentials	Root keys via env injection
At rest	Secrets and CMK material sealed under the data volume
Authn	SigV4 on AWS API paths except documented open/alternate-auth routes (health, ready, JWKS, federation STS, Function URL NONE, HTTP API NONE, AppSync auth types, optional anonymous S3 GetObject behind NOCTAXRIS_ALLOW_ANONYMOUS_S3)
Function egress	Platform deny on noctaxris-fn (unlike AWS Lambda default internet)

Architecture

Loopback API only. Nested DinD over TLS. No host docker.sock.

flowchart LR
  Client["AWS CLI / SDK"] --> Port["127.0.0.1:4566"]
  Port --> API["noctaxris API"]
  API -->|"TLS"| Engine["noctaxris-engine DinD"]
  Engine --> Nested["Lambda / ECS / nested data"]

Full graph and request path: docs/architecture.md.

Docs

docs/index.md	Architecture, configuration, ops, security posture
docs/services/	Per-service APIs, authz notes, CLI smoke
docs/ops.md	Backup, restore, upgrade, graceful shutdown, CI matrix
docs/release.md	Cutting a release (v1.1.0, Hub latest / semver)
tests/README.md	SDK, Terraform, and CloudFormation suites (Compose required)

Author

License

MIT