How do you test boto3-heavy AWS tools without calling real services?
Asked by
MellowQuasar42
I'm building a tool that scans a live AWS account for misconfigurations. The detection logic is manageable, but testing is difficult: I want to avoid constantly calling real AWS services in CI, while also avoiding so much mocking that the tests stop being meaningful. I use moto for simpler cases, but some checks involve interactions across multiple services—for example, comparing an EC2 instance's security group configuration with its actual exposed ports. What approaches have worked well for you: moto, LocalStack, a disposable AWS account, record-and-replay tools, or something else?
Answers
A combination tends to work best. Use mocks for unit tests, then run integration tests against LocalStack or a separate development environment for workflows that span multiple AWS services. That keeps CI fast without relying entirely on unrealistic mocks.
Reply to this answer
For cases where setting up a realistic environment is difficult, a record-and-replay approach can be useful. Tools such as placebo can capture boto3 interactions and replay them in tests, giving you stable fixtures based on real responses without making AWS calls every time.
Reply to this answer
It may also be worth looking at existing AWS security-auditing tools such as ScoutSuite. Even if you don’t use it directly, its implementation and test patterns could provide ideas—or you might be able to extend it instead of building every check from scratch.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions