From 3b078cd7270b220f08e15fd88155b5b62051ee0e Mon Sep 17 00:00:00 2001 From: Waldemar Hummer Date: Sat, 7 Feb 2026 19:20:45 +0100 Subject: [PATCH 01/11] Add proxy support and tests for Lambda service Add Lambda resource matching in the proxy handler (FunctionName/ARN-based) and comprehensive integration tests covering basic proxying, read-only mode, and resource name pattern matching. Co-Authored-By: Claude Opus 4.6 --- aws-proxy/AGENTS.md | 2 +- .../aws_proxy/server/aws_request_forwarder.py | 11 + aws-proxy/tests/proxy/test_lambda.py | 278 ++++++++++++++++++ 3 files changed, 290 insertions(+), 1 deletion(-) create mode 100644 aws-proxy/tests/proxy/test_lambda.py diff --git a/aws-proxy/AGENTS.md b/aws-proxy/AGENTS.md index a69f5d74..bd2d8078 100644 --- a/aws-proxy/AGENTS.md +++ b/aws-proxy/AGENTS.md @@ -13,7 +13,7 @@ You are an AI agent tasked with adding additional functionality or test coverage * You can make modifications to files (no need to prompt for confirmation) * You can delete existing files if needed, but only after user confirmation * You can call different `make` targets (e.g., `make test`) in this repo (no need to prompt for confirmation) -* For each new file created or existing file modified, add a header comment to the file, something like `# Note/disclosure: This file has been (partially or fully) generated by an AI agent.` +* For each new file created or existing file modified, add a header comment to the file, something like `# Note: This file has been (partially or fully) generated by an AI agent.` * The proxy tests are executed against real AWS and may incur some costs, so rather than executing the entire test suite or entire modules, focus the testing on individual test functions within a module only. * Before claiming success, always double-check against real AWS (via `aws` CLI commands) that everything has been cleaned up and there are no leftover resources from the proxy tests. * Never add any `print(..)` statements to the code - use a logger to report any status to the user, if required. diff --git a/aws-proxy/aws_proxy/server/aws_request_forwarder.py b/aws-proxy/aws_proxy/server/aws_request_forwarder.py index a651cc2b..c8601621 100644 --- a/aws-proxy/aws_proxy/server/aws_request_forwarder.py +++ b/aws-proxy/aws_proxy/server/aws_request_forwarder.py @@ -151,6 +151,17 @@ def _request_matches_resource( return False # For metric operations without alarm names, check if pattern is generic return bool(re.match(resource_name_pattern, ".*")) + if service_name == "lambda": + # Lambda function ARN format: arn:aws:lambda:{region}:{account}:function:{name} + function_name = context.service_request.get("FunctionName") or "" + if function_name: + if ":function:" not in function_name: + function_arn = f"arn:aws:lambda:{context.region}:{context.account_id}:function:{function_name}" + else: + function_arn = function_name + return bool(re.match(resource_name_pattern, function_arn)) + # For operations without FunctionName (e.g., ListFunctions), check if pattern is generic + return bool(re.match(resource_name_pattern, ".*")) if service_name == "logs": # CloudWatch Logs ARN format: arn:aws:logs:{region}:{account}:log-group:{name}:* log_group_name = context.service_request.get("logGroupName") or "" diff --git a/aws-proxy/tests/proxy/test_lambda.py b/aws-proxy/tests/proxy/test_lambda.py new file mode 100644 index 00000000..2510a5a5 --- /dev/null +++ b/aws-proxy/tests/proxy/test_lambda.py @@ -0,0 +1,278 @@ +# Note: This file has been (partially or fully) generated by an AI agent. +import io +import json +import logging +import zipfile + +import boto3 +import pytest +from botocore.exceptions import ClientError +from localstack.aws.connect import connect_to +from localstack.utils.strings import short_uid +from localstack.utils.sync import retry + +from aws_proxy.shared.models import ProxyConfig + +LOG = logging.getLogger(__name__) + +LAMBDA_RUNTIME = "python3.12" +LAMBDA_HANDLER = "index.handler" +LAMBDA_HANDLER_CODE = """ +import json +def handler(event, context): + return {"statusCode": 200, "body": json.dumps({"message": "hello", "input": event})} +""" + + +def _create_lambda_zip() -> bytes: + """Create an in-memory ZIP deployment package with a simple handler.""" + buf = io.BytesIO() + with zipfile.ZipFile(buf, "w", zipfile.ZIP_DEFLATED) as zf: + zf.writestr("index.py", LAMBDA_HANDLER_CODE) + return buf.getvalue() + + +@pytest.fixture(scope="module") +def lambda_execution_role(): + """Create a basic IAM role for Lambda execution in real AWS, shared across tests in this module.""" + iam_client = boto3.client("iam") + role_name = f"test-lambda-proxy-role-{short_uid()}" + trust_policy = json.dumps( + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Principal": {"Service": "lambda.amazonaws.com"}, + "Action": "sts:AssumeRole", + } + ], + } + ) + role = iam_client.create_role( + RoleName=role_name, + AssumeRolePolicyDocument=trust_policy, + Description="Test role for Lambda proxy tests", + ) + role_arn = role["Role"]["Arn"] + + # Wait for the role to be usable by Lambda (IAM eventual consistency) + def _wait_for_role(): + iam_client.get_role(RoleName=role_name) + + retry(_wait_for_role, retries=10, sleep=2) + + yield role_arn + + # cleanup + try: + iam_client.delete_role(RoleName=role_name) + except Exception as e: + LOG.warning("Failed to clean up IAM role %s: %s", role_name, e) + + +def _create_lambda_function( + lambda_client_aws, function_name, role_arn, cleanups, env_vars=None +): + """Helper to create a Lambda function in real AWS and register cleanup.""" + kwargs = { + "FunctionName": function_name, + "Runtime": LAMBDA_RUNTIME, + "Role": role_arn, + "Handler": LAMBDA_HANDLER, + "Code": {"ZipFile": _create_lambda_zip()}, + "Timeout": 30, + } + if env_vars: + kwargs["Environment"] = {"Variables": env_vars} + + # Retry create_function to handle IAM role propagation delay + def _create(): + lambda_client_aws.create_function(**kwargs) + + retry(_create, retries=15, sleep=5) + cleanups.append( + lambda: lambda_client_aws.delete_function(FunctionName=function_name) + ) + + # Wait for function to become Active + def _wait_active(): + config = lambda_client_aws.get_function_configuration( + FunctionName=function_name + ) + if config["State"] != "Active": + raise AssertionError( + f"Function {function_name} not active yet: {config['State']}" + ) + + retry(_wait_active, retries=30, sleep=2) + + +def test_lambda_requests(start_aws_proxy, cleanups, lambda_execution_role): + """Test basic Lambda proxy: create in AWS, describe/invoke via LocalStack proxy.""" + function_name_aws = f"test-fn-aws-{short_uid()}" + function_name_local = f"test-fn-local-{short_uid()}" + + # start proxy - only forwarding requests for function name matching the AWS function + config = ProxyConfig( + services={"lambda": {"resources": f".*:function:{function_name_aws}"}} + ) + start_aws_proxy(config) + + # create clients + region_name = "us-east-1" + lambda_client = connect_to(region_name=region_name).lambda_ + lambda_client_aws = boto3.client("lambda", region_name=region_name) + + # create function in real AWS + _create_lambda_function( + lambda_client_aws, function_name_aws, lambda_execution_role, cleanups + ) + + # assert that local call for GetFunction is proxied and returns AWS data + fn_local = lambda_client.get_function(FunctionName=function_name_aws) + fn_aws = lambda_client_aws.get_function(FunctionName=function_name_aws) + assert fn_local["Configuration"]["FunctionName"] == function_name_aws + assert ( + fn_local["Configuration"]["FunctionArn"] + == fn_aws["Configuration"]["FunctionArn"] + ) + assert fn_local["Configuration"]["Runtime"] == LAMBDA_RUNTIME + + # assert that GetFunctionConfiguration is also proxied + config_local = lambda_client.get_function_configuration( + FunctionName=function_name_aws + ) + config_aws = lambda_client_aws.get_function_configuration( + FunctionName=function_name_aws + ) + assert config_local["FunctionArn"] == config_aws["FunctionArn"] + assert config_local["Handler"] == LAMBDA_HANDLER + + # invoke function through proxy and verify it executes on real AWS + response_local = lambda_client.invoke( + FunctionName=function_name_aws, + Payload=json.dumps({"key": "value"}), + ) + payload_local = json.loads(response_local["Payload"].read()) + assert payload_local["statusCode"] == 200 + body = json.loads(payload_local["body"]) + assert body["message"] == "hello" + assert body["input"] == {"key": "value"} + + # invoke via AWS client directly and compare + response_aws = lambda_client_aws.invoke( + FunctionName=function_name_aws, + Payload=json.dumps({"key": "value"}), + ) + payload_aws = json.loads(response_aws["Payload"].read()) + assert payload_aws["statusCode"] == 200 + + # negative test: a non-matching function should NOT exist in AWS + with pytest.raises(ClientError) as ctx: + lambda_client_aws.get_function(FunctionName=function_name_local) + assert ctx.value.response["Error"]["Code"] == "ResourceNotFoundException" + + +def test_lambda_read_only(start_aws_proxy, cleanups, lambda_execution_role): + """Test Lambda proxy in read-only mode: reads proxied, writes/invokes blocked.""" + function_name = f"test-fn-ro-{short_uid()}" + + # start proxy in read-only mode with wildcard resources + config = ProxyConfig(services={"lambda": {"resources": ".*", "read_only": True}}) + start_aws_proxy(config) + + # create clients + region_name = "us-east-1" + lambda_client = connect_to(region_name=region_name).lambda_ + lambda_client_aws = boto3.client("lambda", region_name=region_name) + + # create function in real AWS (direct, not through proxy) + _create_lambda_function( + lambda_client_aws, function_name, lambda_execution_role, cleanups + ) + + # read operations should be proxied + fn_local = lambda_client.get_function(FunctionName=function_name) + fn_aws = lambda_client_aws.get_function(FunctionName=function_name) + assert ( + fn_local["Configuration"]["FunctionArn"] + == fn_aws["Configuration"]["FunctionArn"] + ) + + config_local = lambda_client.get_function_configuration(FunctionName=function_name) + assert config_local["FunctionArn"] == fn_aws["Configuration"]["FunctionArn"] + + # ListFunctions should also be proxied (read operation) + def _list_contains_function(): + functions = lambda_client.list_functions()["Functions"] + func_names = [f["FunctionName"] for f in functions] + assert function_name in func_names + + retry(_list_contains_function, retries=5, sleep=2) + + # Invoke is a write operation - should NOT be proxied in read-only mode. + # The request goes to LocalStack which doesn't have the function, so it should fail. + with pytest.raises(ClientError) as ctx: + lambda_client.invoke( + FunctionName=function_name, + Payload=json.dumps({"key": "value"}), + ) + assert ctx.value.response["Error"]["Code"] == "ResourceNotFoundException" + + # UpdateFunctionConfiguration is a write operation - should also be blocked + with pytest.raises(ClientError) as ctx: + lambda_client.update_function_configuration( + FunctionName=function_name, + Description="updated via proxy - should not work", + ) + assert ctx.value.response["Error"]["Code"] == "ResourceNotFoundException" + + +def test_lambda_resource_name_matching( + start_aws_proxy, cleanups, lambda_execution_role +): + """Test that only functions matching the resource pattern are proxied.""" + fn_match = f"proxy-fn-{short_uid()}" + fn_nomatch = f"local-fn-{short_uid()}" + + # start proxy - only forwarding requests for functions starting with "proxy-fn-" + config = ProxyConfig(services={"lambda": {"resources": ".*:function:proxy-fn-.*"}}) + start_aws_proxy(config) + + # create clients + region_name = "us-east-1" + lambda_client = connect_to(region_name=region_name).lambda_ + lambda_client_aws = boto3.client("lambda", region_name=region_name) + + # create matching function in real AWS + _create_lambda_function( + lambda_client_aws, fn_match, lambda_execution_role, cleanups + ) + + # matching function should be accessible through proxy + fn_local = lambda_client.get_function(FunctionName=fn_match) + fn_aws = lambda_client_aws.get_function(FunctionName=fn_match) + assert ( + fn_local["Configuration"]["FunctionArn"] + == fn_aws["Configuration"]["FunctionArn"] + ) + + # invoke matching function through proxy + response = lambda_client.invoke( + FunctionName=fn_match, + Payload=json.dumps({"test": True}), + ) + payload = json.loads(response["Payload"].read()) + assert payload["statusCode"] == 200 + + # non-matching function should NOT exist in AWS (negative test) + with pytest.raises(ClientError) as ctx: + lambda_client_aws.get_function(FunctionName=fn_nomatch) + assert ctx.value.response["Error"]["Code"] == "ResourceNotFoundException" + + # GetFunction for non-matching name through local client should NOT be proxied + # (goes to LocalStack which doesn't have it either) + with pytest.raises(ClientError) as ctx: + lambda_client.get_function(FunctionName=fn_nomatch) + assert ctx.value.response["Error"]["Code"] == "ResourceNotFoundException" From d0737c632630708387eb0ad150590716a2cbf0f0 Mon Sep 17 00:00:00 2001 From: Waldemar Hummer Date: Fri, 27 Feb 2026 13:25:15 +0100 Subject: [PATCH 02/11] Skip HTTP proxy in base class for TCP-only extensions When all container ports are TCP-only and no host restriction is set, the base class now skips setting up the catch-all HTTP proxy that would intercept all requests. This moves the logic from ParadeDB's override into ProxiedDockerContainerExtension directly. Also temporarily rewrites localstack-extensions-utils dependencies to git+https for CI testing of the utils change across all extensions. Co-Authored-By: Claude Opus 4.6 --- paradedb/localstack_paradedb/extension.py | 18 ------------------ paradedb/pyproject.toml | 2 +- typedb/pyproject.toml | 2 +- utils/localstack_extensions/utils/docker.py | 21 ++++++++++++++++----- wiremock/pyproject.toml | 2 +- 5 files changed, 19 insertions(+), 26 deletions(-) diff --git a/paradedb/localstack_paradedb/extension.py b/paradedb/localstack_paradedb/extension.py index 4732787c..a666bdbf 100644 --- a/paradedb/localstack_paradedb/extension.py +++ b/paradedb/localstack_paradedb/extension.py @@ -3,7 +3,6 @@ from localstack_extensions.utils.docker import ProxiedDockerContainerExtension from localstack import config -from localstack.extensions.api import http # Environment variables for configuration ENV_POSTGRES_USER = "PARADEDB_POSTGRES_USER" @@ -57,23 +56,6 @@ def _tcp_health_check(): tcp_ports=[postgres_port], # Enable TCP proxying through gateway ) - # TODO: this should be migrated into the base class directly ..! - def update_gateway_routes(self, router: http.Router[http.RouteHandler]): - """ - Override to set up only TCP routing without HTTP proxy. - - ParadeDB uses the native PostgreSQL wire protocol (not HTTP), so we - only need TCP protocol routing - not HTTP proxying. Adding an HTTP - proxy without a host restriction would cause all HTTP requests to be - forwarded to the PostgreSQL container, breaking other services. - """ - # Start the container - self.start_container() - - # Set up only TCP protocol routing (skip HTTP proxy from base class) - if self.tcp_ports: - self._setup_tcp_protocol_routing() - def tcp_connection_matcher(self, data: bytes) -> bool: """ Identify PostgreSQL/ParadeDB connections by protocol handshake. diff --git a/paradedb/pyproject.toml b/paradedb/pyproject.toml index de30ab07..d5f13897 100644 --- a/paradedb/pyproject.toml +++ b/paradedb/pyproject.toml @@ -14,7 +14,7 @@ authors = [ keywords = ["LocalStack", "ParadeDB", "PostgreSQL", "Search", "Analytics"] classifiers = [] dependencies = [ - "localstack-extensions-utils" + "localstack-extensions-utils @ git+https://github.com/localstack/localstack-extensions.git@fix/tcp-only-base-class#egg=localstack-extensions-utils&subdirectory=utils" ] [project.urls] diff --git a/typedb/pyproject.toml b/typedb/pyproject.toml index 32f3cbbd..3997f166 100644 --- a/typedb/pyproject.toml +++ b/typedb/pyproject.toml @@ -14,7 +14,7 @@ authors = [ keywords = ["LocalStack", "TypeDB"] classifiers = [] dependencies = [ - "localstack-extensions-utils" + "localstack-extensions-utils @ git+https://github.com/localstack/localstack-extensions.git@fix/tcp-only-base-class#egg=localstack-extensions-utils&subdirectory=utils" ] [project.urls] diff --git a/utils/localstack_extensions/utils/docker.py b/utils/localstack_extensions/utils/docker.py index 0909dddc..be74cbbf 100644 --- a/utils/localstack_extensions/utils/docker.py +++ b/utils/localstack_extensions/utils/docker.py @@ -134,11 +134,22 @@ def update_gateway_routes(self, router: http.Router[http.RouteHandler]): ) # note: for simplicity, starting the external container at startup - could be optimized over time ... self.start_container() - # add resource for HTTP/1.1 requests - resource = RuleAdapter(ProxyResource(self.container_host, self.main_port)) - if self.host: - resource = WithHost(self.host, [resource]) - router.add(resource) + + # Determine if HTTP proxy should be set up. Skip it when all container ports are + # TCP-only and no host restriction is set, since a catch-all HTTP proxy would + # intercept all requests and break other services. + tcp_only = ( + self.tcp_ports + and not self.host + and set(self.container_ports) == set(self.tcp_ports) + ) + + if not tcp_only: + # add resource for HTTP/1.1 requests + resource = RuleAdapter(ProxyResource(self.container_host, self.main_port)) + if self.host: + resource = WithHost(self.host, [resource]) + router.add(resource) # apply patches to serve HTTP/2 requests for port in self.http2_ports or []: diff --git a/wiremock/pyproject.toml b/wiremock/pyproject.toml index 817551a0..5158ecfa 100644 --- a/wiremock/pyproject.toml +++ b/wiremock/pyproject.toml @@ -15,7 +15,7 @@ keywords = ["LocalStack", "WireMock"] classifiers = [] dependencies = [ "priority", - "localstack-extensions-utils" + "localstack-extensions-utils @ git+https://github.com/localstack/localstack-extensions.git@fix/tcp-only-base-class#egg=localstack-extensions-utils&subdirectory=utils" ] [project.urls] From c6daf2ccc5e90c3b59fe4019c57eea44976d3aaa Mon Sep 17 00:00:00 2001 From: Waldemar Hummer Date: Fri, 27 Feb 2026 13:27:55 +0100 Subject: [PATCH 03/11] Add TODO comments for temporary git dep refs Co-Authored-By: Claude Opus 4.6 --- paradedb/pyproject.toml | 1 + typedb/pyproject.toml | 1 + wiremock/pyproject.toml | 1 + 3 files changed, 3 insertions(+) diff --git a/paradedb/pyproject.toml b/paradedb/pyproject.toml index d5f13897..b405a603 100644 --- a/paradedb/pyproject.toml +++ b/paradedb/pyproject.toml @@ -14,6 +14,7 @@ authors = [ keywords = ["LocalStack", "ParadeDB", "PostgreSQL", "Search", "Analytics"] classifiers = [] dependencies = [ + # TODO: temporary git ref for CI testing - revert to "localstack-extensions-utils" before merge "localstack-extensions-utils @ git+https://github.com/localstack/localstack-extensions.git@fix/tcp-only-base-class#egg=localstack-extensions-utils&subdirectory=utils" ] diff --git a/typedb/pyproject.toml b/typedb/pyproject.toml index 3997f166..c54744f0 100644 --- a/typedb/pyproject.toml +++ b/typedb/pyproject.toml @@ -14,6 +14,7 @@ authors = [ keywords = ["LocalStack", "TypeDB"] classifiers = [] dependencies = [ + # TODO: temporary git ref for CI testing - revert to "localstack-extensions-utils" before merge "localstack-extensions-utils @ git+https://github.com/localstack/localstack-extensions.git@fix/tcp-only-base-class#egg=localstack-extensions-utils&subdirectory=utils" ] diff --git a/wiremock/pyproject.toml b/wiremock/pyproject.toml index 5158ecfa..0f791832 100644 --- a/wiremock/pyproject.toml +++ b/wiremock/pyproject.toml @@ -15,6 +15,7 @@ keywords = ["LocalStack", "WireMock"] classifiers = [] dependencies = [ "priority", + # TODO: temporary git ref for CI testing - revert to "localstack-extensions-utils" before merge "localstack-extensions-utils @ git+https://github.com/localstack/localstack-extensions.git@fix/tcp-only-base-class#egg=localstack-extensions-utils&subdirectory=utils" ] From 598f09da26d7266d004541430cd9b37382819f07 Mon Sep 17 00:00:00 2001 From: Waldemar Hummer Date: Fri, 27 Feb 2026 14:09:04 +0100 Subject: [PATCH 04/11] Add localstack to utils runtime dependencies The utils package imports from localstack at runtime (docker.py), so it must be a runtime dependency, not just a dev/test extra. Without this, installing utils via git ref in CI fails with ModuleNotFoundError. Co-Authored-By: Claude Opus 4.6 --- utils/pyproject.toml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/utils/pyproject.toml b/utils/pyproject.toml index c2cf5f71..292e1527 100644 --- a/utils/pyproject.toml +++ b/utils/pyproject.toml @@ -18,6 +18,7 @@ dependencies = [ "hpack", "httpx", "hyperframe", + "localstack", "priority", "requests", "rolo", @@ -32,7 +33,6 @@ dev = [ "boto3", "build", "jsonpatch", - "localstack", "pytest", "ruff", ] @@ -40,7 +40,6 @@ test = [ "grpcio>=1.60.0", "grpcio-tools>=1.60.0", "jsonpatch", - "localstack", "pytest>=7.0", "pytest-timeout>=2.0", ] From 36b00f93d89c839c79c827afdcde9284726f4bc8 Mon Sep 17 00:00:00 2001 From: Waldemar Hummer Date: Fri, 27 Feb 2026 14:12:14 +0100 Subject: [PATCH 05/11] Revert localstack to dev/test extras in utils MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Moving localstack to runtime deps broke the utils CI venv setup. Revert to keeping it in dev/test extras where it was before — the paradedb CI issue is unrelated to this. Co-Authored-By: Claude Opus 4.6 --- utils/pyproject.toml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/utils/pyproject.toml b/utils/pyproject.toml index 292e1527..c2cf5f71 100644 --- a/utils/pyproject.toml +++ b/utils/pyproject.toml @@ -18,7 +18,6 @@ dependencies = [ "hpack", "httpx", "hyperframe", - "localstack", "priority", "requests", "rolo", @@ -33,6 +32,7 @@ dev = [ "boto3", "build", "jsonpatch", + "localstack", "pytest", "ruff", ] @@ -40,6 +40,7 @@ test = [ "grpcio>=1.60.0", "grpcio-tools>=1.60.0", "jsonpatch", + "localstack", "pytest>=7.0", "pytest-timeout>=2.0", ] From bc2816f4605d8cc36068e58698b8638e73964b57 Mon Sep 17 00:00:00 2001 From: Waldemar Hummer Date: Fri, 27 Feb 2026 14:22:37 +0100 Subject: [PATCH 06/11] Fix CI: use localstack-core for dev/test deps, add WireMock to README localstack 4.14.0 no longer depends on localstack-core, making it a thin CLI wrapper. The framework code (localstack.config, localstack.utils etc.) now requires localstack-core explicitly. Update all dev/test dependencies accordingly. Also add WireMock extension to the extensions table in the root README. Co-Authored-By: Claude Opus 4.6 --- README.md | 3 ++- paradedb/pyproject.toml | 2 +- typedb/pyproject.toml | 2 +- utils/pyproject.toml | 4 ++-- wiremock/pyproject.toml | 2 +- 5 files changed, 7 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 123d77db..a138a81a 100644 --- a/README.md +++ b/README.md @@ -76,7 +76,8 @@ You can install the respective extension by calling `localstack extensions insta | [Stripe](https://github.com/localstack/localstack-extensions/tree/main/stripe) | localstack-extension-stripe | 0.2.0 | Stable | | [Terraform Init](https://github.com/localstack/localstack-extensions/tree/main/terraform-init) | localstack-extension-terraform-init | 0.2.0 | Experimental | | [TypeDB](https://github.com/localstack/localstack-extensions/tree/main/typedb) | localstack-extension-typedb | 0.1.3 | Experimental | -| [ParadeDB](https://github.com/localstack/localstack-extensions/tree/main/paradedb) | localstack-extension-paradedb | 0.1.0 | Experimental | +| [WireMock](https://github.com/localstack/localstack-extensions/tree/main/wiremock) | localstack-wiremock | 0.1.0 | Experimental | +| [ParadeDB](https://github.com/localstack/localstack-extensions/tree/main/paradedb) | localstack-extension-paradedb | 0.1.0 | Experimental | ## Developing Extensions diff --git a/paradedb/pyproject.toml b/paradedb/pyproject.toml index b405a603..c3d6e2b9 100644 --- a/paradedb/pyproject.toml +++ b/paradedb/pyproject.toml @@ -26,7 +26,7 @@ dev = [ "boto3", "build", "jsonpatch", - "localstack", + "localstack-core", "psycopg2-binary", "pytest", "rolo", diff --git a/typedb/pyproject.toml b/typedb/pyproject.toml index c54744f0..6cc0215d 100644 --- a/typedb/pyproject.toml +++ b/typedb/pyproject.toml @@ -26,7 +26,7 @@ dev = [ "boto3", "build", "jsonpatch", - "localstack", + "localstack-core", "pytest", "rolo", "ruff", diff --git a/utils/pyproject.toml b/utils/pyproject.toml index c2cf5f71..b0b71bd7 100644 --- a/utils/pyproject.toml +++ b/utils/pyproject.toml @@ -32,7 +32,7 @@ dev = [ "boto3", "build", "jsonpatch", - "localstack", + "localstack-core", "pytest", "ruff", ] @@ -40,7 +40,7 @@ test = [ "grpcio>=1.60.0", "grpcio-tools>=1.60.0", "jsonpatch", - "localstack", + "localstack-core", "pytest>=7.0", "pytest-timeout>=2.0", ] diff --git a/wiremock/pyproject.toml b/wiremock/pyproject.toml index 0f791832..3b8e8d17 100644 --- a/wiremock/pyproject.toml +++ b/wiremock/pyproject.toml @@ -27,7 +27,7 @@ dev = [ "boto3", "build", "jsonpatch", - "localstack", + "localstack-core", "pytest", "rolo", "ruff", From 70695e63d8a50f5a8fddaf90bea48a9beb13cb61 Mon Sep 17 00:00:00 2001 From: Waldemar Hummer Date: Fri, 27 Feb 2026 14:30:09 +0100 Subject: [PATCH 07/11] Add connection retries to ParadeDB test helper PostgreSQL may not be ready to accept queries immediately after the TCP port becomes reachable (Docker port forwarding opens the port before PostgreSQL finishes initialization). Retry the connection to handle this timing window. Co-Authored-By: Claude Opus 4.6 --- paradedb/tests/test_extension.py | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/paradedb/tests/test_extension.py b/paradedb/tests/test_extension.py index 1c2504f0..7151488d 100644 --- a/paradedb/tests/test_extension.py +++ b/paradedb/tests/test_extension.py @@ -1,6 +1,7 @@ import boto3 import psycopg2 from localstack.utils.strings import short_uid +from localstack.utils.sync import retry # Connection details for ParadeDB @@ -13,14 +14,16 @@ def get_connection(): - """Create a connection to ParadeDB.""" - return psycopg2.connect( - host=HOST, - port=PORT, - user=USER, - password=PASSWORD, - database=DATABASE, - ) + """Create a connection to ParadeDB, retrying until the server is ready.""" + def _connect(): + return psycopg2.connect( + host=HOST, + port=PORT, + user=USER, + password=PASSWORD, + database=DATABASE, + ) + return retry(_connect, retries=15, sleep=2.0) def test_connect_to_paradedb(): From 2d9d6257032c053a26963f28127a50fd01f88040 Mon Sep 17 00:00:00 2001 From: Waldemar Hummer Date: Fri, 27 Feb 2026 22:10:42 +0100 Subject: [PATCH 08/11] Update utils/localstack_extensions/utils/docker.py Co-authored-by: Steve Purcell --- utils/localstack_extensions/utils/docker.py | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/utils/localstack_extensions/utils/docker.py b/utils/localstack_extensions/utils/docker.py index be74cbbf..de625723 100644 --- a/utils/localstack_extensions/utils/docker.py +++ b/utils/localstack_extensions/utils/docker.py @@ -138,13 +138,12 @@ def update_gateway_routes(self, router: http.Router[http.RouteHandler]): # Determine if HTTP proxy should be set up. Skip it when all container ports are # TCP-only and no host restriction is set, since a catch-all HTTP proxy would # intercept all requests and break other services. - tcp_only = ( - self.tcp_ports - and not self.host - and set(self.container_ports) == set(self.tcp_ports) + uses_http = ( + self.host + and set(self.container_ports) - set(self.tcp_ports or []) ) - if not tcp_only: + if uses_http: # add resource for HTTP/1.1 requests resource = RuleAdapter(ProxyResource(self.container_host, self.main_port)) if self.host: From d7b6c36ee831750145588afb171c761c033c3740 Mon Sep 17 00:00:00 2001 From: Waldemar Hummer Date: Fri, 27 Feb 2026 23:12:40 +0100 Subject: [PATCH 09/11] temporarily disable build for broken aws-proxy extension (to be fixed soon) --- .github/workflows/aws-proxy.yml | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/.github/workflows/aws-proxy.yml b/.github/workflows/aws-proxy.yml index 6827d298..150e2829 100644 --- a/.github/workflows/aws-proxy.yml +++ b/.github/workflows/aws-proxy.yml @@ -1,15 +1,17 @@ name: LocalStack AWS Proxy Extension Tests on: - push: - paths: - - aws-proxy/** - branches: - - main - pull_request: - paths: - - .github/workflows/aws-proxy.yml - - aws-proxy/** +# TODO: temporarily disabled - AWS proxy codebase needs to be fixed, to accommodate recent +# changes in CLI and runtime repos, see: https://github.com/localstack/localstack/pull/13704 +# push: +# paths: +# - aws-proxy/** +# branches: +# - main +# pull_request: +# paths: +# - .github/workflows/aws-proxy.yml +# - aws-proxy/** workflow_dispatch: jobs: From 8605b94eb4e0d969a4af6cd48db93e81792ba383 Mon Sep 17 00:00:00 2001 From: Waldemar Hummer Date: Fri, 27 Feb 2026 23:25:51 +0100 Subject: [PATCH 10/11] revert temporary changes --- aws-proxy/AGENTS.md | 2 +- .../aws_proxy/server/aws_request_forwarder.py | 11 - aws-proxy/tests/proxy/test_lambda.py | 278 ------------------ paradedb/pyproject.toml | 3 +- typedb/pyproject.toml | 3 +- wiremock/pyproject.toml | 5 +- 6 files changed, 5 insertions(+), 297 deletions(-) delete mode 100644 aws-proxy/tests/proxy/test_lambda.py diff --git a/aws-proxy/AGENTS.md b/aws-proxy/AGENTS.md index bd2d8078..a69f5d74 100644 --- a/aws-proxy/AGENTS.md +++ b/aws-proxy/AGENTS.md @@ -13,7 +13,7 @@ You are an AI agent tasked with adding additional functionality or test coverage * You can make modifications to files (no need to prompt for confirmation) * You can delete existing files if needed, but only after user confirmation * You can call different `make` targets (e.g., `make test`) in this repo (no need to prompt for confirmation) -* For each new file created or existing file modified, add a header comment to the file, something like `# Note: This file has been (partially or fully) generated by an AI agent.` +* For each new file created or existing file modified, add a header comment to the file, something like `# Note/disclosure: This file has been (partially or fully) generated by an AI agent.` * The proxy tests are executed against real AWS and may incur some costs, so rather than executing the entire test suite or entire modules, focus the testing on individual test functions within a module only. * Before claiming success, always double-check against real AWS (via `aws` CLI commands) that everything has been cleaned up and there are no leftover resources from the proxy tests. * Never add any `print(..)` statements to the code - use a logger to report any status to the user, if required. diff --git a/aws-proxy/aws_proxy/server/aws_request_forwarder.py b/aws-proxy/aws_proxy/server/aws_request_forwarder.py index c8601621..a651cc2b 100644 --- a/aws-proxy/aws_proxy/server/aws_request_forwarder.py +++ b/aws-proxy/aws_proxy/server/aws_request_forwarder.py @@ -151,17 +151,6 @@ def _request_matches_resource( return False # For metric operations without alarm names, check if pattern is generic return bool(re.match(resource_name_pattern, ".*")) - if service_name == "lambda": - # Lambda function ARN format: arn:aws:lambda:{region}:{account}:function:{name} - function_name = context.service_request.get("FunctionName") or "" - if function_name: - if ":function:" not in function_name: - function_arn = f"arn:aws:lambda:{context.region}:{context.account_id}:function:{function_name}" - else: - function_arn = function_name - return bool(re.match(resource_name_pattern, function_arn)) - # For operations without FunctionName (e.g., ListFunctions), check if pattern is generic - return bool(re.match(resource_name_pattern, ".*")) if service_name == "logs": # CloudWatch Logs ARN format: arn:aws:logs:{region}:{account}:log-group:{name}:* log_group_name = context.service_request.get("logGroupName") or "" diff --git a/aws-proxy/tests/proxy/test_lambda.py b/aws-proxy/tests/proxy/test_lambda.py deleted file mode 100644 index 2510a5a5..00000000 --- a/aws-proxy/tests/proxy/test_lambda.py +++ /dev/null @@ -1,278 +0,0 @@ -# Note: This file has been (partially or fully) generated by an AI agent. -import io -import json -import logging -import zipfile - -import boto3 -import pytest -from botocore.exceptions import ClientError -from localstack.aws.connect import connect_to -from localstack.utils.strings import short_uid -from localstack.utils.sync import retry - -from aws_proxy.shared.models import ProxyConfig - -LOG = logging.getLogger(__name__) - -LAMBDA_RUNTIME = "python3.12" -LAMBDA_HANDLER = "index.handler" -LAMBDA_HANDLER_CODE = """ -import json -def handler(event, context): - return {"statusCode": 200, "body": json.dumps({"message": "hello", "input": event})} -""" - - -def _create_lambda_zip() -> bytes: - """Create an in-memory ZIP deployment package with a simple handler.""" - buf = io.BytesIO() - with zipfile.ZipFile(buf, "w", zipfile.ZIP_DEFLATED) as zf: - zf.writestr("index.py", LAMBDA_HANDLER_CODE) - return buf.getvalue() - - -@pytest.fixture(scope="module") -def lambda_execution_role(): - """Create a basic IAM role for Lambda execution in real AWS, shared across tests in this module.""" - iam_client = boto3.client("iam") - role_name = f"test-lambda-proxy-role-{short_uid()}" - trust_policy = json.dumps( - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": {"Service": "lambda.amazonaws.com"}, - "Action": "sts:AssumeRole", - } - ], - } - ) - role = iam_client.create_role( - RoleName=role_name, - AssumeRolePolicyDocument=trust_policy, - Description="Test role for Lambda proxy tests", - ) - role_arn = role["Role"]["Arn"] - - # Wait for the role to be usable by Lambda (IAM eventual consistency) - def _wait_for_role(): - iam_client.get_role(RoleName=role_name) - - retry(_wait_for_role, retries=10, sleep=2) - - yield role_arn - - # cleanup - try: - iam_client.delete_role(RoleName=role_name) - except Exception as e: - LOG.warning("Failed to clean up IAM role %s: %s", role_name, e) - - -def _create_lambda_function( - lambda_client_aws, function_name, role_arn, cleanups, env_vars=None -): - """Helper to create a Lambda function in real AWS and register cleanup.""" - kwargs = { - "FunctionName": function_name, - "Runtime": LAMBDA_RUNTIME, - "Role": role_arn, - "Handler": LAMBDA_HANDLER, - "Code": {"ZipFile": _create_lambda_zip()}, - "Timeout": 30, - } - if env_vars: - kwargs["Environment"] = {"Variables": env_vars} - - # Retry create_function to handle IAM role propagation delay - def _create(): - lambda_client_aws.create_function(**kwargs) - - retry(_create, retries=15, sleep=5) - cleanups.append( - lambda: lambda_client_aws.delete_function(FunctionName=function_name) - ) - - # Wait for function to become Active - def _wait_active(): - config = lambda_client_aws.get_function_configuration( - FunctionName=function_name - ) - if config["State"] != "Active": - raise AssertionError( - f"Function {function_name} not active yet: {config['State']}" - ) - - retry(_wait_active, retries=30, sleep=2) - - -def test_lambda_requests(start_aws_proxy, cleanups, lambda_execution_role): - """Test basic Lambda proxy: create in AWS, describe/invoke via LocalStack proxy.""" - function_name_aws = f"test-fn-aws-{short_uid()}" - function_name_local = f"test-fn-local-{short_uid()}" - - # start proxy - only forwarding requests for function name matching the AWS function - config = ProxyConfig( - services={"lambda": {"resources": f".*:function:{function_name_aws}"}} - ) - start_aws_proxy(config) - - # create clients - region_name = "us-east-1" - lambda_client = connect_to(region_name=region_name).lambda_ - lambda_client_aws = boto3.client("lambda", region_name=region_name) - - # create function in real AWS - _create_lambda_function( - lambda_client_aws, function_name_aws, lambda_execution_role, cleanups - ) - - # assert that local call for GetFunction is proxied and returns AWS data - fn_local = lambda_client.get_function(FunctionName=function_name_aws) - fn_aws = lambda_client_aws.get_function(FunctionName=function_name_aws) - assert fn_local["Configuration"]["FunctionName"] == function_name_aws - assert ( - fn_local["Configuration"]["FunctionArn"] - == fn_aws["Configuration"]["FunctionArn"] - ) - assert fn_local["Configuration"]["Runtime"] == LAMBDA_RUNTIME - - # assert that GetFunctionConfiguration is also proxied - config_local = lambda_client.get_function_configuration( - FunctionName=function_name_aws - ) - config_aws = lambda_client_aws.get_function_configuration( - FunctionName=function_name_aws - ) - assert config_local["FunctionArn"] == config_aws["FunctionArn"] - assert config_local["Handler"] == LAMBDA_HANDLER - - # invoke function through proxy and verify it executes on real AWS - response_local = lambda_client.invoke( - FunctionName=function_name_aws, - Payload=json.dumps({"key": "value"}), - ) - payload_local = json.loads(response_local["Payload"].read()) - assert payload_local["statusCode"] == 200 - body = json.loads(payload_local["body"]) - assert body["message"] == "hello" - assert body["input"] == {"key": "value"} - - # invoke via AWS client directly and compare - response_aws = lambda_client_aws.invoke( - FunctionName=function_name_aws, - Payload=json.dumps({"key": "value"}), - ) - payload_aws = json.loads(response_aws["Payload"].read()) - assert payload_aws["statusCode"] == 200 - - # negative test: a non-matching function should NOT exist in AWS - with pytest.raises(ClientError) as ctx: - lambda_client_aws.get_function(FunctionName=function_name_local) - assert ctx.value.response["Error"]["Code"] == "ResourceNotFoundException" - - -def test_lambda_read_only(start_aws_proxy, cleanups, lambda_execution_role): - """Test Lambda proxy in read-only mode: reads proxied, writes/invokes blocked.""" - function_name = f"test-fn-ro-{short_uid()}" - - # start proxy in read-only mode with wildcard resources - config = ProxyConfig(services={"lambda": {"resources": ".*", "read_only": True}}) - start_aws_proxy(config) - - # create clients - region_name = "us-east-1" - lambda_client = connect_to(region_name=region_name).lambda_ - lambda_client_aws = boto3.client("lambda", region_name=region_name) - - # create function in real AWS (direct, not through proxy) - _create_lambda_function( - lambda_client_aws, function_name, lambda_execution_role, cleanups - ) - - # read operations should be proxied - fn_local = lambda_client.get_function(FunctionName=function_name) - fn_aws = lambda_client_aws.get_function(FunctionName=function_name) - assert ( - fn_local["Configuration"]["FunctionArn"] - == fn_aws["Configuration"]["FunctionArn"] - ) - - config_local = lambda_client.get_function_configuration(FunctionName=function_name) - assert config_local["FunctionArn"] == fn_aws["Configuration"]["FunctionArn"] - - # ListFunctions should also be proxied (read operation) - def _list_contains_function(): - functions = lambda_client.list_functions()["Functions"] - func_names = [f["FunctionName"] for f in functions] - assert function_name in func_names - - retry(_list_contains_function, retries=5, sleep=2) - - # Invoke is a write operation - should NOT be proxied in read-only mode. - # The request goes to LocalStack which doesn't have the function, so it should fail. - with pytest.raises(ClientError) as ctx: - lambda_client.invoke( - FunctionName=function_name, - Payload=json.dumps({"key": "value"}), - ) - assert ctx.value.response["Error"]["Code"] == "ResourceNotFoundException" - - # UpdateFunctionConfiguration is a write operation - should also be blocked - with pytest.raises(ClientError) as ctx: - lambda_client.update_function_configuration( - FunctionName=function_name, - Description="updated via proxy - should not work", - ) - assert ctx.value.response["Error"]["Code"] == "ResourceNotFoundException" - - -def test_lambda_resource_name_matching( - start_aws_proxy, cleanups, lambda_execution_role -): - """Test that only functions matching the resource pattern are proxied.""" - fn_match = f"proxy-fn-{short_uid()}" - fn_nomatch = f"local-fn-{short_uid()}" - - # start proxy - only forwarding requests for functions starting with "proxy-fn-" - config = ProxyConfig(services={"lambda": {"resources": ".*:function:proxy-fn-.*"}}) - start_aws_proxy(config) - - # create clients - region_name = "us-east-1" - lambda_client = connect_to(region_name=region_name).lambda_ - lambda_client_aws = boto3.client("lambda", region_name=region_name) - - # create matching function in real AWS - _create_lambda_function( - lambda_client_aws, fn_match, lambda_execution_role, cleanups - ) - - # matching function should be accessible through proxy - fn_local = lambda_client.get_function(FunctionName=fn_match) - fn_aws = lambda_client_aws.get_function(FunctionName=fn_match) - assert ( - fn_local["Configuration"]["FunctionArn"] - == fn_aws["Configuration"]["FunctionArn"] - ) - - # invoke matching function through proxy - response = lambda_client.invoke( - FunctionName=fn_match, - Payload=json.dumps({"test": True}), - ) - payload = json.loads(response["Payload"].read()) - assert payload["statusCode"] == 200 - - # non-matching function should NOT exist in AWS (negative test) - with pytest.raises(ClientError) as ctx: - lambda_client_aws.get_function(FunctionName=fn_nomatch) - assert ctx.value.response["Error"]["Code"] == "ResourceNotFoundException" - - # GetFunction for non-matching name through local client should NOT be proxied - # (goes to LocalStack which doesn't have it either) - with pytest.raises(ClientError) as ctx: - lambda_client.get_function(FunctionName=fn_nomatch) - assert ctx.value.response["Error"]["Code"] == "ResourceNotFoundException" diff --git a/paradedb/pyproject.toml b/paradedb/pyproject.toml index c3d6e2b9..70e07018 100644 --- a/paradedb/pyproject.toml +++ b/paradedb/pyproject.toml @@ -14,8 +14,7 @@ authors = [ keywords = ["LocalStack", "ParadeDB", "PostgreSQL", "Search", "Analytics"] classifiers = [] dependencies = [ - # TODO: temporary git ref for CI testing - revert to "localstack-extensions-utils" before merge - "localstack-extensions-utils @ git+https://github.com/localstack/localstack-extensions.git@fix/tcp-only-base-class#egg=localstack-extensions-utils&subdirectory=utils" + "localstack-extensions-utils" ] [project.urls] diff --git a/typedb/pyproject.toml b/typedb/pyproject.toml index 6cc0215d..ff92a59a 100644 --- a/typedb/pyproject.toml +++ b/typedb/pyproject.toml @@ -14,8 +14,7 @@ authors = [ keywords = ["LocalStack", "TypeDB"] classifiers = [] dependencies = [ - # TODO: temporary git ref for CI testing - revert to "localstack-extensions-utils" before merge - "localstack-extensions-utils @ git+https://github.com/localstack/localstack-extensions.git@fix/tcp-only-base-class#egg=localstack-extensions-utils&subdirectory=utils" + "localstack-extensions-utils" ] [project.urls] diff --git a/wiremock/pyproject.toml b/wiremock/pyproject.toml index 3b8e8d17..72012ada 100644 --- a/wiremock/pyproject.toml +++ b/wiremock/pyproject.toml @@ -14,9 +14,8 @@ authors = [ keywords = ["LocalStack", "WireMock"] classifiers = [] dependencies = [ - "priority", - # TODO: temporary git ref for CI testing - revert to "localstack-extensions-utils" before merge - "localstack-extensions-utils @ git+https://github.com/localstack/localstack-extensions.git@fix/tcp-only-base-class#egg=localstack-extensions-utils&subdirectory=utils" + "localstack-extensions-utils", + "priority" ] [project.urls] From 9764a045a9f5c70c3068602690888b40f59ec3d6 Mon Sep 17 00:00:00 2001 From: Waldemar Hummer Date: Fri, 27 Feb 2026 23:33:34 +0100 Subject: [PATCH 11/11] update README and version for Wiremock extension --- wiremock/README.md | 11 +++++++++++ wiremock/pyproject.toml | 2 +- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/wiremock/README.md b/wiremock/README.md index 5100b0fe..4d082c40 100644 --- a/wiremock/README.md +++ b/wiremock/README.md @@ -108,6 +108,8 @@ localstack start - `WIREMOCK_API_TOKEN`: Your WireMock Cloud API token (required for runner mode) - `WIREMOCK_CONFIG_DIR`: Path to the directory containing your `.wiremock` folder (required for runner mode) +- `WIREMOCK_IMAGE`: Custom Docker image name for the Wiremock OSS image (default: `wiremock/wiremock`) +- `WIREMOCK_IMAGE_RUNNER`: Custom Docker image name for the Wiremock Cloud runner image (default: `wiremock/wiremock-runner`) Note: When using the LocalStack CLI, prefix environment variables with `LOCALSTACK_` to forward them to the container. @@ -118,3 +120,12 @@ See the `sample-app-runner/` directory for a complete example using Terraform th - Creating an API Gateway - Lambda function that calls WireMock stubs - Integration testing with mocked external APIs + +## Change Log + +- `0.1.1`: Add environment variables to customize the WireMock image names +- `0.1.0`: Initial release of the extension + +## License + +This project is licensed under the Apache License, Version 2.0. diff --git a/wiremock/pyproject.toml b/wiremock/pyproject.toml index 72012ada..dae2581e 100644 --- a/wiremock/pyproject.toml +++ b/wiremock/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta" [project] name = "localstack-wiremock" -version = "0.1.0" +version = "0.1.1" description = "WireMock Extension for LocalStack" readme = {file = "README.md", content-type = "text/markdown; charset=UTF-8"} requires-python = ">=3.9"