I'm building a tool that scans a live AWS account for misconfigurations. The detection logic is manageable, but testing is difficult: I want to avoid constantly calling real AWS services in CI, while also avoiding so much mocking that the tests stop being meaningful. I use moto for simpler cases, but some checks involve interactions across multiple services—for example, comparing an EC2 instance's security group configuration with its actual exposed ports. What approaches have worked well for you: moto, LocalStack, a disposable AWS account, record-and-replay tools, or something else?
3 Answers
It may also be worth looking at existing AWS security-auditing tools such as ScoutSuite. Even if you don’t use it directly, its implementation and test patterns could provide ideas—or you might be able to extend it instead of building every check from scratch.
For cases where setting up a realistic environment is difficult, a record-and-replay approach can be useful. Tools such as placebo can capture boto3 interactions and replay them in tests, giving you stable fixtures based on real responses without making AWS calls every time.
A combination tends to work best. Use mocks for unit tests, then run integration tests against LocalStack or a separate development environment for workflows that span multiple AWS services. That keeps CI fast without relying entirely on unrealistic mocks.
Related Questions
XML Signature Verifier
Voltage Divider Calculator
SSL Certificate Decoder
SQL Formatter
Online Font Playground to Test Google or Custom Fonts
File Hash Generator Online – Get Instant MD5 and SHA-256 Hashes