Each service provides AWS-compatible API operations emulated at runtime. In CDK mode, CDK constructs are parsed from your cdk synth output. In HCL mode, all services start in always-on mode and resources are created dynamically via management APIs.
tableName, partitionKey, sortKey, globalSecondaryIndexes
Backed by SQLite. Supports expression attribute names/values, filter expressions, condition expressions, transactional operations, and eventual consistency simulation.
queueName, fifo, visibilityTimeout, contentBasedDeduplication, deadLetterQueue
Supports message attributes, long polling, FIFO queues, batch operations, and dead-letter queue wiring from RedrivePolicy.
bucketName, websiteIndexDocument, websiteErrorDocument
Backed by the local filesystem. Supports event notifications (ObjectCreated, ObjectRemoved), multipart uploads, presigned URL generation, ETags, binary content, content-type headers, and static website hosting with index document resolution and error document serving.
topicName. aws_sns.Subscription is not parsed — subscriptions are wired at runtime via the API or auto-wired by LDK for Lambda/SQS targets.
Supports Lambda and SQS subscription protocols, message attributes, topic and subscription attribute management, and fan-out to multiple subscribers.
eventBusName, ruleName, eventBus, eventPattern, schedule, targets
Supports custom event buses, event pattern matching, schedule expressions (rate and cron), Lambda targets, and input transformations.
stateMachineName, definitionBody, stateMachineType
State types: Task, Pass, Choice, Wait, Succeed, Fail, Parallel, Map. Supports JSONPath (InputPath, OutputPath, ResultPath), error handling (Retry, Catch), definition validation, and Standard & Express workflows.
userPoolName, lambdaTriggers (preAuthentication, postConfirmation), passwordPolicy, userPool
Backed by SQLite. Supports JWT token generation (ID, access, refresh), user attributes, password hashing, password reset flows, and multi-pool management.
handler, runtime, code, timeout, memorySize, environment, authType, cors, invokeMode
Runs functions inside official AWS Lambda Docker images (with AWS SDK pre-installed). Run ldk setup lambda once to pull the images. Supports timeout enforcement, realistic context objects, environment variable injection, and Function URLs — each function URL gets its own HTTP endpoint on a dedicated port with full CORS support and AWS Lambda payload format 2.0. Supports both BUFFERED and RESPONSE_STREAM invoke modes. In CDK mode, functions and URLs are discovered from the cloud assembly. In HCL mode, functions are created dynamically via the management API.
routes, methods, integrations
Supports both REST API (V1) and HTTP API (V2) with Lambda proxy integration. Features include CORS handling, TOKEN and JWT authorizers, multi-value query parameters, multi-value headers, binary payload support (base64 encoding), path parameters, and request/response mapping. In HCL mode, APIs and routes are created dynamically via the management API.
Name, Type, Value, Description
In-memory parameter store supporting String, StringList, and SecureString types with hierarchical paths, tagging, and version tracking. In CDK mode, parameters defined in the CloudFormation template are pre-seeded on startup.
Name, Description, SecretString, GenerateSecretString
In-memory secret store with version tracking (AWSCURRENT/AWSPREVIOUS staging labels), soft delete/restore, resource policies, and tagging support. In CDK mode, secrets defined in the CloudFormation template are pre-seeded on startup.
containerDefinitions, taskDefinition
Runs services as local subprocesses. Supports health checking, service discovery, file watching with auto-restart, and port mapping. Supports local command overrides via ldk.local_command metadata. CDK mode only.
IAM role and policy operations are accepted and stored in memory. STS returns credentials and caller identity for HCL compatibility. IAM authorization can be configured in three modes: disabled (default — all requests pass through), audit (requests pass through but violations are logged as warnings), or enforce (requests that fail IAM checks are denied with HTTP 403). Supports identity-based policies, permissions boundaries, resource policies, wildcard matching, and per-request identity override via HTTP header. Authorization applies to DynamoDB, S3, SQS, SNS, EventBridge, Step Functions, Cognito, SSM, and Secrets Manager.
Stub APIs for HCL compatibility. Supports cluster and instance lifecycle operations with identifier-based filtering.
Stub APIs for HCL compatibility. Supports MongoDB-compatible cluster lifecycle operations.
Stub APIs for HCL compatibility. Supports graph database cluster lifecycle with Gremlin endpoint exposure.
Stub APIs for HCL compatibility. Supports domain lifecycle operations.
Stub APIs for HCL compatibility. Supports domain lifecycle operations.
Stub APIs for HCL compatibility. Supports cache cluster lifecycle with status tracking.
Stub APIs for HCL compatibility. Supports Redis-compatible cluster lifecycle with status tracking.
Stub APIs for HCL compatibility. Supports idempotent vault creation and listing.
Stub APIs for HCL compatibility. Supports table buckets with namespace-based table organization.