Skip to content
This repository was archived by the owner on Mar 23, 2026. It is now read-only.

Migrate IAM/STS from moto to LocalStack#13720

Closed
dfangl wants to merge 39 commits into
mainfrom
iam/moto-migration
Closed

Migrate IAM/STS from moto to LocalStack#13720
dfangl wants to merge 39 commits into
mainfrom
iam/moto-migration

Conversation

@dfangl

@dfangl dfangl commented Feb 9, 2026

Copy link
Copy Markdown
Member

Motivation

This is a feature PR for the entire migration of IAM and STS services from moto to the core LocalStack codebase.

(Relevant) contribution should be made via separate PRs

Changes

  • ...

Tests

Tests will be migrated and AWS validated from moto

Related

IAM/STS internalization project

@dfangl dfangl added this to the 4.14 milestone Feb 9, 2026
@dfangl dfangl added semver: minor Non-breaking changes which can be included in minor releases, but not in patch releases docs: skip Pull request does not require documentation changes notes: needed Pull request should be mentioned in the release notes labels Feb 9, 2026
@github-actions

github-actions Bot commented Feb 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Test Results - Preflight, Unit

23 104 tests  ±0   21 217 ✅ ±0   6m 13s ⏱️ -5s
     1 suites ±0    1 887 💤 ±0 
     1 files   ±0        0 ❌ ±0 

Results for commit 708a15e. ± Comparison against base commit 9642b8e.

♻️ This comment has been updated with latest results.

@dfangl dfangl force-pushed the iam/moto-migration branch from d08f4b8 to bfc7836 Compare February 10, 2026 17:47
@github-actions

github-actions Bot commented Feb 10, 2026 •
edited
Loading

Copy link
Copy Markdown

LocalStack Community integration with Pro

    2 files  ±  0      2 suites  ±0   2h 9m 52s ⏱️ + 5m 4s
5 662 tests +307  5 039 ✅ +55  372 💤 +1  251 ❌ +251 
5 664 runs  +307  5 039 ✅ +55  374 💤 +1  251 ❌ +251 

For more details on these failures, see this check.

Results for commit 708a15e. ± Comparison against base commit 9642b8e.

This pull request removes 10 and adds 317 tests. Note that renamed tests count towards both. 
tests.aws.services.iam.test_iam.TestIAMIntegrations ‑ test_create_describe_role
tests.aws.services.iam.test_iam.TestIAMIntegrations ‑ test_list_roles_with_permission_boundary
tests.aws.services.iam.test_iam.TestIAMIntegrations ‑ test_role_attach_policy
tests.aws.services.iam.test_iam.TestIAMIntegrations ‑ test_update_assume_role_policy
tests.aws.services.iam.test_iam.TestRoles ‑ test_role_with_tags
tests.aws.services.sts.test_sts.TestSTSIntegrations ‑ test_get_caller_identity_role_access_key[False]
tests.aws.services.sts.test_sts.TestSTSIntegrations ‑ test_get_caller_identity_role_access_key[True]
tests.aws.services.sts.test_sts.TestSTSIntegrations ‑ test_get_caller_identity_root
tests.aws.services.sts.test_sts.TestSTSIntegrations ‑ test_get_caller_identity_user_access_key[False]
tests.aws.services.sts.test_sts.TestSTSIntegrations ‑ test_get_caller_identity_user_access_key[True]

tests.aws.services.iam.test_iam_account_aliases.TestIAMAccountAliases ‑ test_account_alias_lifecycle
tests.aws.services.iam.test_iam_account_authorization_details.TestGetAccountAuthorizationDetails ‑ test_get_account_authorization_details_filter_aws_managed_policy
tests.aws.services.iam.test_iam_account_authorization_details.TestGetAccountAuthorizationDetails ‑ test_get_account_authorization_details_filter_group
tests.aws.services.iam.test_iam_account_authorization_details.TestGetAccountAuthorizationDetails ‑ test_get_account_authorization_details_filter_local_managed_policy
tests.aws.services.iam.test_iam_account_authorization_details.TestGetAccountAuthorizationDetails ‑ test_get_account_authorization_details_filter_role
tests.aws.services.iam.test_iam_account_authorization_details.TestGetAccountAuthorizationDetails ‑ test_get_account_authorization_details_filter_user
tests.aws.services.iam.test_iam_account_authorization_details.TestGetAccountAuthorizationDetails ‑ test_get_account_authorization_details_no_filter
tests.aws.services.iam.test_iam_account_authorization_details.TestGetAccountAuthorizationDetails ‑ test_get_account_authorization_details_with_inline_policies
tests.aws.services.iam.test_iam_account_authorization_details.TestGetAccountAuthorizationDetails ‑ test_get_account_authorization_details_with_tags
tests.aws.services.iam.test_iam_account_password_policy.TestAccountPasswordPolicy ‑ test_delete_account_password_policy
…

♻️ This comment has been updated with latest results.

@github-actions

github-actions Bot commented Feb 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Test Results (amd64) - Acceptance

7 tests  ±0   5 ✅ ±0   3m 6s ⏱️ +14s
1 suites ±0   2 💤 ±0 
1 files   ±0   0 ❌ ±0 

Results for commit 708a15e. ± Comparison against base commit 9642b8e.

♻️ This comment has been updated with latest results.

@github-actions

github-actions Bot commented Feb 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Test Results (amd64) - Integration, Bootstrap

    5 files      5 suites   2h 40m 24s ⏱️
6 067 tests 5 538 ✅ 528 💤 1 ❌
6 073 runs  5 538 ✅ 534 💤 1 ❌

For more details on these failures, see this check.

Results for commit 708a15e.

♻️ This comment has been updated with latest results.

@dfangl dfangl force-pushed the iam/moto-migration branch 3 times, most recently from 7211a8d to aabae16 Compare February 17, 2026 13:30
@github-actions

github-actions Bot commented Feb 18, 2026 •
edited
Loading

Copy link
Copy Markdown

S3 Image Test Results (AMD64 / ARM64)

    2 files    2 suites   8m 7s ⏱️
  573 tests 466 ✅  56 💤  51 ❌
1 146 runs  932 ✅ 112 💤 102 ❌

For more details on these failures, see this check.

Results for commit 9655ffd.

♻️ This comment has been updated with latest results.

@dfangl dfangl force-pushed the iam/moto-migration branch from 49e13e2 to cbcd0f4 Compare February 19, 2026 18:50
@dfangl dfangl modified the milestones: 4.14, 2026.03 Feb 24, 2026
@localstack-bot

localstack-bot commented Feb 26, 2026

Copy link
Copy Markdown
Contributor

Currently, only patch changes are allowed on main. Your PR labels (semver: minor, docs: skip, notes: needed) indicate that it cannot be merged into the main at this time.

@dfangl dfangl force-pushed the iam/moto-migration branch 4 times, most recently from 449d4e1 to 2770dfd Compare March 4, 2026 13:48
dfangl and others added 27 commits March 6, 2026 12:03
@dfangl
Migrate MFA, server certificate and signing certificate tests (#13783)
571deba
@dfangl
Migrate IAM AWS managed policy tests from moto to LS (#13767)
430ca51
@dfangl @simonrw
Migrate IAM credential reports, account summary and account authoriza…
217fda4 
…tion detail tests (#13785)

Co-authored-by: Simon Walker <simon.walker@localstack.cloud>
@pinzon @dfangl
Migrate IAM OIDC Tests to LocalStack (#13787)
1eff7c7
@dfangl
Migrate IAM managed policies (#13790)
b15ee85
@dfangl
Migrate IAM role implementation (#13798)
cdb3432
@dfangl
Migrate IAM user implementation (#13806)
c2084af
@pinzon @dfangl
IAM: Migrate Groups (#13810)
a062e35
@pinzon @dfangl
IAM Implement account password policy feature (#13788)
2ea9d42 
Co-authored-by: Daniel Fangl <daniel.fangl@localstack.cloud>
@pinzon @dfangl
IAM: Implement SAML provider operations (#13794)
7fcf82c 
Co-authored-by: Daniel Fangl <daniel.fangl@localstack.cloud>
@pinzon @dfangl
IAM: Implement SSH Public feature operations (#13793)
b4b909f 
Co-authored-by: Daniel Fangl <daniel.fangl@localstack.cloud>
@pinzon @dfangl
IAM: Migrate OIDC Operations (#13800)
f15c4cb 
Co-authored-by: Daniel Fangl <daniel.fangl@localstack.cloud>
@pinzon @dfangl
IAM: Migrate instance profiles (#13811)
80eda1b 
Co-authored-by: Daniel Fangl <daniel.fangl@localstack.cloud>
@pinzon @dfangl
IAM: Migrate MFA Operations (#13801)
178d1d0
@dfangl
Migrate IAM AWS managed policies (#13836)
f87be26
@dfangl
Migrate IAM access keys (#13838)
21e77a6
@dfangl
IAM: Migrate server and signing certificates (#13840)
7c2b292
@dfangl
Migrate IAM list entities for policy operation (#13841)
75f2587
@dfangl
Implement CredentialsReport, AccountSummary and AccountAuthorizationD…
21491c7 
…etails (#13845)
@dfangl
Migrate IAM policy simulator (#13843)
4411c07
@dfangl
Implement IAM account aliases (#13855)
45ffe1e
@dfangl
Cleanup IAM provider (#13856)
969dbcf
@pinzon @dfangl
STS: New internalized STS provider (#13737)
be341de
@dfangl
Integrate new STS provider with S3 and pro (#13877)
ebebad1
@dfangl
Adapt new IAM provider to use new Tags concept (#13884)
d5aa4f0
@dfangl
IAM: Fix user renaming propagation (#13889)
b04c14c
@dfangl
IAM/STS: fix avro compatibility for new providers (#13891)
708a15e
@dfangl dfangl force-pushed the iam/moto-migration branch from 9655ffd to 708a15e Compare March 6, 2026 11:03
@dfangl dfangl closed this Mar 9, 2026
@alexrashed alexrashed deleted the iam/moto-migration branch March 13, 2026 07:21
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@k-a-il k-a-il Awaiting requested review from k-a-il k-a-il will be requested when the pull request is marked ready for review k-a-il is a code owner

@dominikschubert dominikschubert Awaiting requested review from dominikschubert dominikschubert will be requested when the pull request is marked ready for review dominikschubert is a code owner

@alexrashed alexrashed Awaiting requested review from alexrashed alexrashed will be requested when the pull request is marked ready for review alexrashed is a code owner

Assignees

No one assigned

Labels

docs: skip Pull request does not require documentation changes notes: needed Pull request should be mentioned in the release notes semver: minor Non-breaking changes which can be included in minor releases, but not in patch releases

Projects

None yet

Milestone

2026.03

Development

Successfully merging this pull request may close these issues.

3 participants

@dfangl @localstack-bot @pinzon