Noctaxris

README

Run AWS-shaped security labs on your laptop without a cloud bill or a host Docker socket.

docker pull kyaxris/noctaxris:latest
docker run -d --name noctaxris -p 127.0.0.1:4566:4566 \
  -e NOCTAXRIS_LISTEN=0.0.0.0:4566 \
  -e NOCTAXRIS_ALLOW_NONLOOPBACK_LISTEN=1 \
  -e NOCTAXRIS_ROOT_ACCESS_KEY_ID=AKIAROOTEXAMPLE01 \
  -e NOCTAXRIS_ROOT_SECRET_ACCESS_KEY='wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY' \
  kyaxris/noctaxris:latest
curl http://127.0.0.1:4566/_noctaxris/health
# ok

Point the AWS CLI or SDK at it and call the lab services the same way you would against real AWS.

Go module: github.com/Kyaxris-Labs/Noctaxris. Image tags: latest, semver releases, and nightly from CI.

Why this exists

Lab fidelity	Identity evaluation with boundaries, SCP/RCP filters, PassRole, and condition keys
Secure defaults	Loopback publish only. No host docker.sock. Secrets and CMK material sealed at rest
Nested compute	DinD via Compose noctaxris-engine over TLS. Live Invoke needs a healthy engine. Default engine is restricted (privileged: false + caps/cgroup); use compose.engine-privileged.yaml only if nested smoke fails on your host
CLI-shaped	Latest AWS CLI v2 via --endpoint-url

Quick start

Pull the Hub image, run it on loopback :4566, then hit STS and S3 with the same root keys you passed in.

docker pull kyaxris/noctaxris:latest

docker run -d --name noctaxris -p 127.0.0.1:4566:4566 \
  -e NOCTAXRIS_LISTEN=0.0.0.0:4566 \
  -e NOCTAXRIS_ALLOW_NONLOOPBACK_LISTEN=1 \
  -e NOCTAXRIS_ROOT_ACCESS_KEY_ID=AKIAROOTEXAMPLE01 \
  -e NOCTAXRIS_ROOT_SECRET_ACCESS_KEY='wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY' \
  kyaxris/noctaxris:latest

curl http://127.0.0.1:4566/_noctaxris/health
curl http://127.0.0.1:4566/_noctaxris/ready

export AWS_ACCESS_KEY_ID=AKIAROOTEXAMPLE01
export AWS_SECRET_ACCESS_KEY='wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'
export AWS_DEFAULT_REGION=us-east-1
EP=http://127.0.0.1:4566

aws configure set default.s3.addressing_style path
aws sts get-caller-identity --endpoint-url "$EP"
aws s3 mb s3://lab-bucket --endpoint-url "$EP"
aws kms create-key --endpoint-url "$EP"

Nested Lambda, ECS, and data engines need Compose with noctaxris-engine (docker compose -f docker/compose.yaml --env-file docker/.env up --build). Per-service CLI smoke: docs/services/.

Services

Area	Services
Identity	IAM, STS, Organizations, Cognito User Pools
Crypto	KMS
Data	S3, DynamoDB, DynamoDB Streams, SQS, SSM, Secrets Manager, SNS, EventBridge, Scheduler, Pipes, S3 Vectors, RDS, RDS Data API, ElastiCache, DocumentDB
Audit and tags	CloudTrail, CloudWatch Logs, Resource Groups Tagging API
Streams and delivery	Kinesis, Firehose, Amazon MQ, Transfer Family, SES, AppConfig, Step Functions
IaC, edge, and governance	CloudFormation, Cloud Control, Glue, WAF v2, Config, ACM, Route 53, Cloud Map, CloudFront, ELB v2
Compute	Lambda, ECR, ECS, CodeBuild, CodePipeline, CodeDeploy, Batch, AppSync
API edge	API Gateway HTTP API
Analytics and AI	Athena, OpenSearch, EMR, Bedrock Runtime, Textract, Transcribe
Billing	Pricing, BCM Data Exports, Cost Explorer, Budgets

Expand for detailed actions and gaps. Full notes and CLI smoke: docs/services/.

Service matrix (detailed actions / not implemented)

Area	Services	Detailed actions	Not implemented
Identity	IAM	Users, roles, managed and inline policies, managed policy versions (max five), access keys, groups, permissions boundaries, instance profiles (including ListInstanceProfilesForRole), OIDC and SAML IdP CRUD, virtual MFA.	Out of lab scope: service-linked roles, full pagination and tagging parity. PassRole trust aws:SourceArn on Lambda, EventBridge PutTargets, ECS, Scheduler, Pipes, Secrets rotate, API Gateway CredentialsArn, and Cognito trigger RoleArn.
	STS	All 11 actions (lab MFA on GetSessionToken).	Out of lab scope: deeper AssumeRoot, DecodeAuthorizationMessage, GetDelegatedAccessToken, and GetWebIdentityToken parity.
	Organizations	CreateAccount, ListAccounts, OUs, MoveAccount, EnablePolicyType, SCP and RCP create/attach/detach/describe. SCP/RCP collection walks account, OU path to root, and root. Identity, boundary, SCP, and RCP apply on shared authorize and dataplane paths.	Out of lab scope: account invites and handshake control-plane beyond MoveAccount.
	Cognito User Pools	Pool and app client CRUD (UpdateUserPool), AdminCreateUser / SignUp / ConfirmSignUp / ForgotPassword / ConfirmForgotPassword / ResendConfirmationCode / UpdateUserAttributes / GetUserAttributeVerificationCode / VerifyUserAttribute, InitiateAuth USER_PASSWORD_AUTH / USER_SRP_AUTH (PASSWORD_VERIFIER) / CUSTOM_AUTH (Define/Create/Verify; optional SRP nesting SRP_A → PASSWORD_VERIFIER → CUSTOM_CHALLENGE) plus REFRESH_TOKEN_AUTH / REFRESH_TOKEN with refresh rotation, RevokeToken (unsigned public IdP; Admin* stay SigV4), TOTP MFA (AssociateSoftwareToken / VerifySoftwareToken / RespondToAuthChallenge), lab RoleArn + LambdaConfig with PassRole for cognito-idp.amazonaws.com and sync Invoke of PreSignUp / PostConfirmation / PreAuthentication / PostAuthentication / PreTokenGeneration (V1 ID-token claimsOverrideDetails) / CustomMessage_SignUp / AdminCreateUser / ForgotPassword / ResendCode / UpdateUserAttribute / VerifyUserAttribute (render/store SMS/email body; no SES) / UserMigration_Authentication (password auth) / custom-auth Define/Create/Verify, RS256 ID and access tokens, JWKS on /cognito-idp/REGION/POOL/.well-known/jwks.json.	Out of lab scope: Identity Pools, Hosted UI, SMS/email MFA (CustomMessage_Authentication), Adaptive auth / UI customization. Blocked: UserMigration on USER_SRP_AUTH (AWS requires password auth; SRP obscures the password).
Crypto	KMS	Customer-managed keys, key policies (same-account key-policy-required, cross-account identity and key policy both Allow), Encrypt/Decrypt/GenerateDataKey*/ReEncrypt, grants, aliases (including lab alias/aws/s3|dynamodb|sqs), ListResourceTags/TagResource/UntagResource and CreateKey Tags, ScheduleKeyDeletion/CancelKeyDeletion (cancel leaves Disabled), on-read sweeper after DeletionDate, key-material rotation (enable rotates sealed material, lab auto-rotate by period).	Out of lab scope: Sign/Verify, MAC, asymmetric/HMAC specs, import, multi-Region, RotateKeyOnDemand API shape, cross-account grant flows, true AWS-owned managed keys. (Resource tags ship: ListResourceTags / TagResource / UntagResource / CreateKey Tags.)
Data	S3	Path-style buckets and objects, bucket policy (same-account identity or policy, cross-account both Allow), SSE-S3/SSE-KMS, presigned GET/PUT, multipart upload (5 MiB min non-final parts), CopyObject (same account), bucket default encryption, versioning lite (Put/GetBucketVersioning, version-aware Get/Put, ListObjectVersions lite), Put/GetBucketNotificationConfiguration with emit on Put/Delete/CompleteMultipart to Lambda/SQS/EventBridge/SNS (empty config = off; destination authz re-checked).	Out of lab scope: lifecycle, CORS/website, Object Lock, replication, access points, virtual-hosted style, ACL cross-account, delete markers depth, multipart presign, exact AWS notification retry timing.
	DynamoDB	Tables, item CRUD, Query/Scan with up to two lab GSIs, BatchGet/BatchWrite, TransactWriteItems/TransactGetItems (same-account Put/Delete/Update SET/REMOVE/ConditionCheck lab subset with ConditionExpression, ClientRequestToken idempotency, stream append on success, soft cap 25), table resource policies (same-account or, cross-account and), CMK encryption, TTL configure and lazy expiry. Stream enablement for DynamoDB Streams lab core.	Out of lab scope: more than two GSIs, LSI, PartiQL, global tables, cross-account / XA transact, live PITR, billing depth.
	DynamoDB Streams	Enable stream on table (NEW_IMAGE, OLD_IMAGE, NEW_AND_OLD_IMAGES, or KEYS_ONLY), ListStreams/DescribeStream, GetShardIterator/GetRecords. Change records on Put/Update/DeleteItem and TransactWrite Put/Delete/Update when enabled. Lambda ESM + FilterCriteria (Keys/NewImage/OldImage) for streams: see Lambda row.	Out of lab scope: global tables, parallel shard fan-out / ParallelizationFactor.
	SQS	Standard and FIFO queues, send/receive/delete (batch and visibility), deduplication, queue policies (same-account or, cross-account and), SSE-SQS and SSE-KMS, RedrivePolicy to DLQ with RedriveAllowPolicy enforcement, DelaySeconds (queue and per-message).	Out of lab scope: high-throughput FIFO quotas, StartMessageMoveTask parity, tags beyond basics.
	SSM Parameter Store	String, StringList, and SecureString parameters, Put/Get/GetParameters/GetParametersByPath/Delete/Describe, path hierarchy with Recursive, KMS via KeyId or alias/aws/ssm, identity EvaluateFull authz.	Out of lab scope: parameter policies, labels, tags, documents/sessions/automation, full pagination parity, cross-account parameter access.
	Secrets Manager	Create/Get/Put/Delete/Restore/Rotate/Describe/List, resource policies (same-account or, cross-account and), KMS via alias/aws/secretsmanager, recovery window on delete (7-30 days) with on-read sweeper, multi-version stages (AWSCURRENT/AWSPENDING/AWSPREVIOUS, UpdateSecretVersionStage), RotateSecret (random replacement by default; optional RotationLambdaARN with PassRole for secretsmanager.amazonaws.com then four-step createSecret/setSecret/testSecret/finishSecret Invokes), RotationRules (AutomaticallyAfterDays or rate/cron ScheduleExpression with lists/ranges/steps / L / nW / LW / # / DOW+month names + optional Duration in-window jitter) with RotateImmediately=false deferral and in-process due ticker.	Out of lab scope: tags, replication, ListSecrets filtering, random-password APIs, true AWS-owned alias, service-linked grant that skips caller KMS.
	SNS	Topic CRUD including FIFO (.fifo, MessageGroupId/dedup), Publish, Subscribe and Unsubscribe (including XA Subscribe to foreign topic ARNs), List*, Get/SetTopicAttributes, Get/SetSubscriptionAttributes (lab FilterPolicy + RawMessageDelivery), Add/RemovePermission, topic policies (same-account or, cross-account and), confirmed sqs/lambda delivery (destination policy must Allow sns.amazonaws.com; foreign SQS and Lambda ARNs supported) plus loopback HTTP(S) catcher (deny-by-default egress).	Out of lab scope: SMS, email, nested filter-policy operators, RedrivePolicy DLQ delivery, HT FIFO quotas, exact AWS retry timing. Will not ship: open-internet HTTP(S) webhooks (loopback catcher only).
	EventBridge	Default and custom buses, Put/Describe/List/Delete/Enable/Disable Rule, Put/Remove/List Targets, PutPermission/RemovePermission (optional Condition), PutEvents with lab pattern match (source, detail-type, nested detail operators) and bus-policy dual-eval (bus ARN for XA). Targets SQS, Lambda, SNS, Logs, Kinesis, and Step Functions via RoleArn or destination resource policy (events.amazonaws.com + SourceArn; empty policy skips delivery); foreign targets RoleArn AND dest policy. PassRole plus events.amazonaws.com trust on PutTargets RoleArn. Lab InputPath and InputTransformer on delivery.	Out of lab scope: partner buses, archive/replay, API Destinations, legacy scheduled rules, remaining pattern ops (wildcard/$or/cidr), InputPath bracket/wildcard notation, exact retry timing.
	EventBridge Scheduler	Distinct Scheduler API: Create/Get/Update/Delete/ListSchedules. Rate plus cron subset (including DOM nW/LW, L, #, month/DOW names) and optional at(...). Targets Lambda, SQS, SNS, Step Functions. PassRole for scheduler.amazonaws.com. Foreign targets use ARN account I/O and RoleArn plus resource policy AND. In-process ticker.	Out of lab scope: flexible windows, full retry/DLQ matrix, schedule groups depth, universal targets beyond Lambda/SQS/SNS/SFN.
	EventBridge Pipes	Create/Describe/Delete/ListPipes. Source SQS, DynamoDB Streams, or EventBridge bus to target Lambda or SQS. Optional Lambda Enrichment. PassRole for pipes.amazonaws.com when RoleArn set. Continuous in-process ticker plus PollPipeOnce. Bus sources require RoleArn session Allow on events:PutEvents. RoleArn session or target resource policy on deliver (foreign AND).	Out of lab scope: filter partner matrix, enrichment HTTP/API destinations, cross-account bus source depth beyond RoleArn.
	S3 Vectors	Vector bucket and index CRUD, PutVectors / QueryVectors with in-process cosine or euclidean ranking. Identity authz.	Full condition-key matrix, huge dimensional indexes, metadata filter depth.
	RDS	CreateDBInstance / DescribeDBInstances / DeleteDBInstance for engine postgres. Nested Postgres via DinD data-plane helper when engine is up. Nested-network endpoint only. Master credentials in Secrets Manager.	Out of lab scope: MySQL, Multi-AZ, read replicas, Aurora full cluster matrix, IAM DB auth tokens. Will not ship: host-published Postgres ports (Data API on :4566 only).
	RDS Data API	ExecuteStatement and BatchExecuteStatement on :4566. Requires resourceArn and secretArn. Prefers pgx against the nested data-plane DSN (typed OID fields + named parameters); falls back to nested psql when the wire dial fails. Real Begin/Commit/Rollback via held pgx sessions (txn-scoped Execute/Batch); otherwise DatabaseUnavailableException (no canned SELECT). formatRecordsAs=JSON; Batch generatedFields from RETURNING via pgx.	Out of lab scope: ExecuteSql legacy, AWS 3-minute idle (lab 5m), cross-process transaction resume. Nested pgx dial still needs API reachability to the DinD data network.
	ElastiCache	CreateCacheCluster / DescribeCacheClusters / DeleteCacheCluster for redis or valkey. Status creating until nested Valkey/Redis starts; available only with engine. Nested-network endpoint only.	Cluster mode / replication group matrix, Redis AUTH depth, MemoryDB, host-published cache ports.
	DocumentDB	CreateDBCluster / DescribeDBClusters / DeleteDBCluster (Engine=docdb). Status creating until nested Mongo-compatible starts; available only with engine. Nested-network endpoint only. Not Neptune.	Neptune, change streams, full TLS client auth matrix, host-published document ports.
Audit and tags	CloudTrail	LookupEvents over local cloudtrail/events.jsonl with time and attribute filters. CreateTrail/DescribeTrails/DeleteTrail/StartLogging/StopLogging: StartLogging delivers one lab JSONL snapshot to in-account S3 and optional CloudWatch Logs then sets IsLogging; while logging, new JSONL lines ship continuously to the same destinations (PassRole for Logs role; fail closed if Put fails).	Selectors, Insights, Lake, organization trails, cross-account lookup.
	CloudWatch Logs	Create/DeleteLogGroup, Create/DeleteLogStream, DescribeLogGroups/DescribeLogStreams, PutRetentionPolicy/DeleteRetentionPolicy (AWS-allowed day values; expired events purged), PutLogEvents/GetLogEvents, FilterLogEvents (optional stream names, time bounds, lab filterPattern subset: space-AND terms, quoted phrases, ?/* globs, optional -term exclude; lab page cap), account Put/Get/Delete/DescribeResourcePolicies, Put/Delete/DescribeSubscriptionFilters to Lambda (awslogs envelope) or lab SQS under destination owner, Put/Delete/DescribeMetricFilters with honest metricFilterCount and store datapoints. Identity EvaluateFull; PassRole on subscription roleArn.	Out of lab scope: Insights query engine, full CloudWatch filter syntax, full Metrics/Alarms API, Kinesis/Firehose/OpenSearch subscription destinations, full pagination parity.
	Resource Groups Tagging API	TagResources, UntagResources, GetResources with TagFilters and ResourceTypeFilters over a lab ARN tag map.	Resource Groups CRUD, GroupBy, tag policy compliance, service-native tag API parity.
Streams and delivery	Kinesis Data Streams	Create/Delete/Describe/ListStreams with ShardCount 1..4, PutRecord/PutRecords (partition-key hash to shard), GetShardIterator/GetRecords per shard, stream Put/Get/DeleteResourcePolicy. Lambda event source mapping polls all shards sequentially: see Lambda row.	Shard split/merge APIs, enhanced fan-out, encryption depth, Kinesis Data Analytics.
	Firehose	Delivery stream CRUD, PutRecord/PutRecordBatch. S3 destination writes objects. Lambda ARN destination persists records and enqueues async Invoke. OpenSearch destination Create/Put only when the domain is Active with a non-stub nested endpoint (allowlisted hosts; RoleARN + es:ESHttpPut required; skip without engine). Describe returns AmazonopensearchserviceDestinationDescription plus lab OpenSearchDestinationDescription. PassRole for firehose.amazonaws.com; Put evaluates RoleARN session or destination resource policy (S3/Lambda).	HTTP endpoint destinations, dynamic partitioning, OpenSearch domain resource policy, live sync Lambda Invoke from delivery.
	Amazon MQ	CreateBroker/DescribeBroker/ListBrokers/DeleteBroker. RabbitMQ or ActiveMQ nested DinD when engine up (CREATION_IN_PROGRESS→RUNNING, Internal AMQP). No DinD → CREATION_FAILED + stub://. PubliclyAccessible=true rejected. No host/WAN broker ports. Lambda MQ ESM Create when RUNNING (see Lambda row).	MSK/Kafka, full admin APIs, public broker endpoints. Blocked: ActiveMQ AMQP 1.0/JMS consumer for Lambda ESM (dial-only empty batch).
	Transfer Family	CreateServer/DescribeServer/ListServers/DeleteServer, CreateUser/DeleteUser. Servers report ONLINE. Lab file Put/Get/List on /transfer/{serverId}/home/{user}/... or JSON PutFile/GetFile/ListDirectory under the sandbox (path traversal fail-closed). Omits EndpointType (no VPC theatre); EndpointDetails rejected; PassRole on CreateUser Role. Not a real SFTP listener.	AS2, FTPS depth, IdP integration, WAN expose, live SSH/SFTP listener.
	SES	VerifyEmailIdentity (lab auto-verify), SendEmail/SendRawEmail catcher, ListIdentities, GetSendStatistics stub. No outbound SMTP.	Real relay, receipt rules, configuration sets, SES v2 depth.
	AppConfig	CreateApplication/Environment/ConfigurationProfile, hosted configuration versions, StartDeployment/GetDeployment/ListDeployments (immediate DEPLOYED), GetConfiguration and AppConfigData GetLatestConfiguration return the deployed version pointer.	Deployment strategies, validators, extensions, gradual rollout, feature-flag profile depth.
	Step Functions	Create/Delete/Describe/List state machines, StartExecution/DescribeExecution/GetExecutionHistory. ASL Pass/Succeed/Fail/Choice (String/Numeric Equals/GreaterThan/LessThan, BooleanEquals, IsPresent)/Wait/Parallel/Map and Task to Lambda (sync Invoke), SQS, SNS, or EventBridge bus. Wait Seconds clamped 0–5; Parallel and Map run sequentially in-process (array merge). Top-level InputPath/ResultPath on Pass/Task/Parallel/Map. Task definitions require roleArn. EventBridge and Scheduler can StartExecution with RoleArn; EventBridge may omit RoleArn when a lab state-machine resource policy Allows events.amazonaws.com. PassRole with states.amazonaws.com when RoleArn set. Foreign Task targets AND destination resource policy; PutEvents dual-evals bus policy.	Express workflows, Callback/Activity, Choice And/Or/Not, concurrent Parallel/Map, Timestamp Wait, OutputPath, Map ItemProcessor/distributed mode.
IaC, edge, and governance	CloudFormation	CreateStack/Describe/List/Delete/UpdateStack. ChangeSet Add/Remove plus allowlisted in-place Modify (unknown Modify types or immutable props fail closed). Nested stacks (lab S3 TemplateURL). Drift lite. Types: S3 Bucket(+BucketPolicy, NotificationConfiguration), IAM Role/User/Group/ManagedPolicy/Policy, SQS(+QueuePolicy, create attrs), DynamoDB, Lambda(+Permission with FunctionUrlAuthType), KMS Key/Alias, SNS(+TopicPolicy/Subscription FilterPolicy), Logs LogGroup(+RetentionInDays), Events bus/rule (ScheduleExpression fail-closed), SSM, Secrets, nested Stack. JSON/YAML + DependsOn + Ref/GetAtt/Sub/Join. Unknown types/props fail closed. Optional PassRole.	Out of lab scope: Modify beyond allowlist (including nested Stack), nested drift depth, full intrinsic matrix, broader catalog, custom IAM Path ≠ /, Events Rule ScheduleExpression, Lambda Permission PrincipalOrgID/EventSourceToken, SNS RedrivePolicy DLQ delivery.
	Cloud Control	Create/Get/List/Update/Delete + GetResourceRequestStatus for CFN-aligned allowlist (no Stack/QueuePolicy). UpdateResource property-object PatchDocument for documented mutable subsets (including IAM User/Group/ManagedPolicy, EventBus Policy, LogGroup RetentionInDays). Sync ProgressEvent SUCCESS with recorded tokens. Unknown types and unknown patch keys fail closed.	Out of lab scope: RFC6902 PatchDocument, async ProgressEvent polling beyond recorded SUCCESS, private registry types.
	Glue	Data Catalog database and table CRUD over sqlite (Create/Get/GetDatabases/GetTables/Delete*). Tables store PartitionKeys plus StorageDescriptor SerDe/InputFormat fields for Athena. Crawler lite: Create/Start/Get/Delete/ListCrawlers sync-infers CSV/JSON tables from S3 prefixes. Identity authz.	ETL jobs, Lake Formation, partition value registration, nested Spark.
	WAF v2	Create/Update/Get/List WebACL, CreateRuleGroup, AssociateWebACL to lab HTTP API / execute-api / AppSync / Lambda function ARNs / ALB loadbalancer/app/... with an invoke gate (REST API, NLB, Cognito rejected), invoke-path DefaultAction gate, ByteMatch on UriPath/SingleHeader (CONTAINS/EXACTLY), SizeConstraint (UriPath/SingleHeader size compare), inline IPSetReference (CIDR vs SourceIP), labeled Evaluate helper. No real edge PoP.	Real PoP / CAPTCHA / Bot Control, full statement catalog, managed IPSet resources beyond inline Addresses.
	Config	PutConfigurationRecorder, PutDeliveryChannel (existing S3 bucket), StartConfigurationRecorder writes one lab-shaped JSON snapshot per delivery channel then sets recording (fail closed if PutObject fails) + ConfigurationRecorderStarted SNS, DescribeComplianceByConfigRule returns NOT_APPLICABLE. Optional PassRole for config.amazonaws.com.	Full AWS Config item schema, continuous history stream, managed rule catalog, remediations, aggregator, organization rules.
	ACM	RequestCertificate/DescribeCertificate/ListCertificates/DeleteCertificate. Lab self-signed PEM via stdlib. No public CA.	Real public CA, live DNS validation propagation, imported cert workflows beyond Put.
	Route 53	CreateHostedZone/DeleteHostedZone/ListHostedZones, ChangeResourceRecordSets/ListResourceRecordSets for A and CNAME, plus Type A AliasTarget to in-account CloudFront DomainName or ELB DNSName (no recursive DNS). Identity authz.	AAAA alias, traffic policies, health checks, Resolver endpoints.
	Cloud Map	CreatePrivateDnsNamespace (requires lab-opaque Vpc) or HTTP namespace, CreateService, RegisterInstance/DeregisterInstance, DiscoverInstances scoped by Vpc for private DNS.	Full DNS / Route 53 private hosted zones, EC2-validated VPC IDs, health checks depth.
	CloudFront	CreateDistribution/GetDistribution/ListDistributions/DeleteDistribution. Origins must be existing lab S3 buckets or HTTP API ids. Create returns Deployed plus lab DomainName. SigV4 edge GET /cloudfront/{id}/{key...} fetches first origin (S3 or internal HTTP API). No real PoP.	Real CDN, signed cookies depth, multi-behavior / multi-origin matrices.
	ELB v2	CreateLoadBalancer/CreateTargetGroup/CreateListener/CreateRule/Describe*/Delete*. Type application only (network rejected). Target types lambda or ip. Path-pattern and host-header listener rules (exact or trailing * prefix; AND when both present) select target group on lab listener /alb/{account}/{name}/{port}/... (loopback open dataplane gate). RegisterTargets requires function resolve and elasticloadbalancing.amazonaws.com permission. DescribeTargetHealth healthy when a listener or rule forwards and permission Allows; IP stays unused. No EC2.	ALB Cognito auth action, HTTP-header / query-string conditions, IP target dataplane, NLB.
Compute	Lambda	Zip or Image CreateFunction through UpdateConfiguration, PublishVersion and aliases, layers (max 5, /opt on zip and Image Invoke), sync and async Invoke (Event with SQS DLQ/OnFailure), SQS, DynamoDB Streams, Kinesis, and Amazon MQ event source mappings (MQ Create requires RUNNING nested broker; allowlisted noctaxris-mq-* only; RabbitMQ AMQP 0-9-1 Dial + basic.get on queue noctaxris returns real bodies; ActiveMQ stays dial-then-empty; unit tests may inject MQReceiveFunc), FilterCriteria (EventBridge operators on SQS body / DynamoDB Keys, NewImage, and OldImage / Kinesis data and partitionKey), and ReportBatchItemFailures, Function URLs lite (NONE with CORS * or AllowOrigins allowlist, or AWS_IAM on /lambda-url/...), runtimes python3.11/python3.12/nodejs20.x, Invoke qualifiers, AddPermission/GetPolicy/RemovePermission (lab foreign IAM principals and service-principal XA grants with SourceAccount/SourceArn), ImageUri pull of lab ECR 127.0.0.1:4566/ACCOUNT/REPO:tag with Registry V2 auth, PassRole plus lambda.amazonaws.com trust, nested DinD with TLS (no host docker.sock), platform egress deny. Live Invoke requires healthy noctaxris-engine.	Out of lab scope: Enhanced fan-out / ParallelizationFactor Kinesis ESM, ActiveMQ AMQP 1.0/JMS consumer for MQ ESM (dial-only empty), FilterCriteria $or/wildcard/cidr and FilterCriteria KMS encryption, provisioned concurrency, weighted aliases, Function URL CORS methods/headers depth, EventBridge/Lambda OnFailure destinations, fully rootless nested engine (default is already restricted DinD; privileged opt-in exists), full SAR depth. Will not ship: non-lab private registries (lab ECR on :4566 only).
	ECR	Create/Describe/DeleteRepository, GetAuthorizationToken, repository policies (same-account or, cross-account and), PutImage/BatchGetImage/ListImages/BatchDeleteImage, Registry V2 on 127.0.0.1:4566 with token auth (monolithic PUT and chunked PATCH blob uploads), DinD sync on manifest put for ECS and Lambda Image.	Out of lab scope: scanning, replication, lifecycle, OCI referrers / multi-arch index depth, public galleries, fully rootless nested engine.
	ECS	Register/Describe/List/DeregisterTaskDefinition (requires taskRoleArn and executionRoleArn), RunTask/Describe/List/Stop, CreateService/UpdateService/DeleteService/DescribeServices/ListServices with DesiredCount lab reconciler, DescribeClusters/ListClusters, PassRole plus ecs-tasks.amazonaws.com trust, nested DinD on noctaxris-ecs Internal network (host-gateway ExtraHosts off by default; opt in with NOCTAXRIS_INJECT_ECS_HOST_GATEWAY=1 or docker/compose.lab-ecs-host-gateway.yaml), task-role credential injection. Live RunTask requires healthy noctaxris-engine.	Out of lab scope: load balancers, awsvpc ENI, capacity providers, ECS Exec, Service Connect, autoscaling/circuit breakers/placement/EBS/Firelens, multi-cluster, fully rootless nested engine (default is already restricted DinD; privileged opt-in exists), full SAR depth.
	CodeBuild	CreateProject, StartBuild, BatchGetBuilds, ListBuilds. Inline or S3 buildspec. PassRole with codebuild.amazonaws.com. Nested DinD via the shared compute client (no host docker.sock).	VPC, fleets, CodeCommit, batch build matrix, artifact publishing depth.
	CodePipeline	CreatePipeline/GetPipeline/DeletePipeline, StartPipelineExecution, GetPipelineState. Requires at least one CodeBuild action. StartPipelineExecution calls nested CodeBuild StartBuild for each ProjectName. Optional PassRole for codepipeline.amazonaws.com.	Full action catalog, approvals, cross-region.
	CodeDeploy	CreateApplication/CreateDeploymentGroup/CreateDeployment/GetDeployment/ListDeployments. Sync Succeeded. Optional PassRole for codedeploy.amazonaws.com. Optional ECS DesiredCount refresh or Lambda PublishVersion when a group stores those targets.	Blue/green traffic shifting, EC2 agent, on-premises instances.
	Batch	CreateComputeEnvironment, CreateJobQueue, RegisterJobDefinition, SubmitJob, Describe*. PassRole for batch.amazonaws.com service role and ecs-tasks.amazonaws.com job role. Nested DinD SubmitJob.	Array/multi-node jobs, fair-share, Fargate/EC2 capacity fidelity.
	AppSync	Create/Get/List/DeleteGraphqlApi, schema store, CreateApiKey, Lambda data sources with optional serviceRoleArn (PassRole + appsync.amazonaws.com trust), multi-field Query and nested object field resolvers (selection depth ≤ 3), GraphQL POST that Invokes Lambda. Auth API_KEY, AWS_IAM, or AMAZON_COGNITO_USER_POOLS (Bearer JWT via lab Cognito JWKS).	Amplify, subscriptions/MQTT, AppSync JS/VTL runtimes, OIDC beyond Cognito, field arguments/aliases/fragments.
API edge	API Gateway HTTP API	CreateApi/GetApi/UpdateApi/GetApis/DeleteApi, CreateIntegration, GetIntegrations, CreateAuthorizer, GetAuthorizers, CreateRoute, GetRoutes, CreateStage. REST /v2/apis... is routed before lab ECR Registry /v2/. Lambda AWS_PROXY only. Optional CorsConfiguration (origins/methods/headers/MaxAge/credentials; OPTIONS preflight without an OPTIONS route). Route auth NONE, JWT (Cognito JWKS), AWS_IAM (execute-api:Invoke), or CUSTOM REQUEST Lambda authorizer (simple isAuthorized / IAM policy; Deny short-circuits before integration). Optional CredentialsArn PassRole for apigateway.amazonaws.com. Invoke on /http-api/{apiId}/{stage}/{path}.	Out of lab scope: REST API v1, WebSocket, REST TOKEN authorizers, authorizer result caching, custom domains beyond ACM string link, HTTP API resource policies. Will not ship: HTTP_PROXY / VPC link integrations.
Analytics and AI	Athena	StartQueryExecution / GetQueryExecution / GetQueryResults / StopQueryExecution. In-process SELECT subset over Glue catalog plus lab S3 CSV/JSON, including WHERE equality, COUNT(*), INNER JOIN, GROUP BY + COUNT(*), ORDER BY. Missing S3 location buckets fail closed. Optional ResultConfiguration OutputLocation.	Full SQL (outer joins, LIKE/IN, multi-aggregate GROUP BY), CTAS, federated catalogs, nested Trino/Presto/Spark.
	OpenSearch	CreateDomain / DescribeDomain / ListDomainNames / DeleteDomain. Nested DinD when engine up (Creating→Active, Internal :9200). Else CreateFailed + stub:// (never Active on stub); lab FailureReason when mmap / memory-lock bootstrap is classified. SigV4 lab query facade PUT/POST /opensearch/{domain}/lab/... (_doc index + allowlisted _search) to nested hosts only. No host search ports.	Full query DSL, fine-grained access control, automatic host sysctl (operator must raise vm.max_map_count for Active).
	EMR	RunJobFlow / DescribeCluster / ListClusters / TerminateJobFlows control-plane stub. No host Spark/Hadoop.	Full step matrix, nested Spark engines, EMR Serverless and Studio.
	Bedrock Runtime	InvokeModel over allowlisted modelIds with canned JSON. Unknown modelId fails closed. No real foundation models.	Converse, streaming, Agents, Guardrails, real model runtimes.
	Textract	DetectDocumentText and AnalyzeDocument over Bytes or lab S3Object. Canned PAGE/LINE/WORD Blocks. No real OCR.	Async analysis APIs, Queries/Forms/Tables depth, real OCR.
	Transcribe	StartTranscriptionJob / GetTranscriptionJob / ListTranscriptionJobs. Requires existing lab s3:// media object. Canned transcript under the data root. No real ASR.	Streaming transcription, Call Analytics, writing transcripts into lab S3.
Billing	Pricing	DescribeServices/GetAttributeValues/GetProducts over a tiny static embedded price list. Identity authz.	Live AWS price list sync.
	BCM Data Exports	CreateExport/GetExport/ListExports/DeleteExport. Sample CSV/JSON under the data root. Identity authz.	Scheduled CUR delivery to S3, Parquet variants.
	Cost Explorer	GetCostAndUsage and GetCostForecast over seeded lab amounts. Identity authz.	Live AWS CE sync, anomaly detection, rightsizing recommendations.
	Budgets	CreateBudget/DescribeBudget/DescribeBudgets/DeleteBudget. SNS subscriber ARNs under NotificationsWithSubscribers receive one lab LAB_CREATE Publish on CreateBudget (not ACTUAL).	Budget actions that mutate accounts, RI/SP coverage, live CE-driven ACTUAL/FORECASTED threshold evaluation.

Defaults

Setting	Value
Listen	127.0.0.1:4566 only
Docker	No host docker.sock (nested noctaxris-engine for Lambda, ECS, CodeBuild, Batch, and nested data engines)
Compute runtime	Nested DinD only (NOCTAXRIS_COMPUTE_RUNTIME unset or dind). Live Lambda/ECS compute needs healthy noctaxris-engine
Data ports	Compose publishes only 127.0.0.1:4566. Nested DataKind ports stay off the host
API replicas	One process per data root. Multi-replica against the same SQLite volume is unsupported and can corrupt state
Credentials	Root keys via env injection
At rest	Secrets and CMK material sealed under the data volume
Authn	SigV4 on AWS API paths except documented open/alternate-auth routes (health, ready, JWKS, federation STS, Function URL NONE, HTTP API NONE, AppSync auth types, optional anonymous S3 GetObject behind NOCTAXRIS_ALLOW_ANONYMOUS_S3)
Function egress	Platform deny on noctaxris-fn (unlike AWS Lambda default internet)

Architecture

Loopback API only. Nested DinD over TLS. No host docker.sock.

flowchart LR
  Client["AWS CLI / SDK"] --> Port["127.0.0.1:4566"]
  Port --> API["noctaxris API"]
  API -->|"TLS"| Engine["noctaxris-engine DinD"]
  Engine --> Nested["Lambda / ECS / nested data"]

Full graph and request path: docs/architecture.md.

Docs

docs/index.md	Architecture, configuration, ops, security posture
docs/services/	Per-service APIs, authz notes, CLI smoke
docs/ops.md	Backup, restore, upgrade, graceful shutdown, CI matrix
docs/release.md	Cutting a release (v1.1.2, Hub latest / semver)
tests/README.md	SDK, Terraform, and CloudFormation suites (Compose required)

Contributors

License

MIT