Run Cloud Custodian against LocalStack

[ajkerrigan]

For testing or demo purposes it can sometimes be helpful to run Cloud Custodian policies against mock services. One way to do that is by:

• Running LocalStack
• Defining AWS config settings that point to your LocalStack endpoints
• Using a wrapper command that forces Custodian to talk to the LocalStack endpoints

Note that this is experimental and does not cover all use cases, but for some common resource types it can be a useful tool in your policy authoring/testing toolbelt.

[ajkerrigan]

Thanks to changes in boto3 >= 1.28 this has become so much easier 🥳 . You now have two options:

1. Define a localstack profile in ~/.aws/config that uses endpoint_url to target your running localstack instance. Example:

[profile localstack]
region                = us-east-2
output                = json
aws_access_key_id     = fake
aws_secret_access_key = fake
endpoint_url          = http://localhost:4566

2. Use the AWS_ENDPOINT_URL environment variable at runtime:

> aws sts get-caller-identity

{
    "UserId": "AROA...:aj@speckledmonkey.com",
    "Account": "<real account id>",
    "Arn": "arn:aws:sts::<real>:assumed-role/..."
}

> env AWS_ENDPOINT_URL=http://localhost:4566 aws sts get-caller-identity

{
    "UserId": "AKIAIOSFODNN7EXAMPLE",
    "Account": "000000000000",
    "Arn": "arn:aws:iam::000000000000:root"
}

No plugins, no wrappers, carry on with your lives!

Note: If you're getting a bit more advanced and using this with event-based policies, you'll also need to specify an endpoint override in your policy's mode block. For example:

policies:
  - name: root-user-login-detected
    resource: aws.account
    mode:
      type: cloudtrail
      events:
        - ConsoleLogin
      role: ajtest
      # Make sure we have current versions of boto3 and botocore that support custom endpoint URLs...
      packages: [boto3, botocore]
      environment:
        Variables:
          AWS_ENDPOINT_URL: http://localhost:4566