How do I mock the AWS STS + IAM API locally?

Install stunt, add a one-service block to stunt.yaml (adapter: embedded:aws-iam-sts-style), and run stunt up. You get a local, stateful stand-in for AWS STS + IAM API 2011-06-15 — 2 routes over rest — with no remote account, no network, and no bills.

Is the AWS STS + IAM API mock data synthetic?

Yes — entirely. The adapter returns generated data only; stunt's adapter lint rejects real-looking secrets and PII at build time. It simulates the shape and behavior of AWS STS + IAM API (routes, status codes, pagination, webhooks), never real records.

← all adapters

aws-iam-sts-style

simulates AWS STS + IAM API 2011-06-15

restadapter v0.1.02 routes

verification

SDKverified with aws-sdk-go-v2 v1.43.7· surface 2 · not implemented 3 · differs 3

use it

# add to stunt.yaml
services:
  aws-iam-sts:
    adapter: embedded:aws-iam-sts-style

# then
$ stunt up

The embedded: source extracts this adapter from the binary — no git clone, fully offline.

how to mock the AWS STS + IAM API locally

Install stunt, paste the service block above into stunt.yaml, run stunt up — then point your client at localhost instead of AWS STS + IAM API. It works offline, keeps state across requests and restarts, and every response is synthetic: the route shapes, status codes, pagination, and webhook delivery follow the real AWS STS + IAM API 2011-06-15 surface — the data is fake, the behavior is real.

backing stores

temp_credentialsrolesusersaccess_keys

api surface (2)

generated from the adapter manifest — exactly what boots, nothing more

2 routes

GET/

POST/

SDK-verified behaviors (2)

✓GetCallerIdentity with real SigV4 signature
✓AssumeRole -> credentials

Not implemented (3)

No UpdateRole/DeleteRole, role policy ops, user CRUD, groups, or policies
No access-key list/update/delete beyond CreateAccessKey
No AssumeRoleWithSAML

Differs from the real API (3)

Canonical path/query rebuilt from decoded values — duplicate query keys indistinguishable
RFC 1123 Date header fallback not parsed — x-amz-date is required
Only the documented example AKID/secret validates (single credential pair)

full scorecard →

want more of the AWS STS + IAM API surface? adapters are YAML + Starlark — the authoring guide covers adding routes, fixtures, and state machines. Open an issue for anything big first, or just file a PR — merged routes ship in the next release.