Reference
Coverage
What each emulated service does today, and what it does not yet.
Every service is tested with the official SDK for its cloud. Terraform (hashicorp/aws 6.x, google and azurerm) and the CDK CLI run against pogi in
scripts/conformance.sh.
Depth:
- Deep: real behavior, plus wiring to other services.
- Core: the main API, with real semantics.
- Thin: create, describe and delete. That is enough for infrastructure tools such as Terraform.
ARNs use the right prefix for the region (aws, aws-cn for China, aws-us-gov for GovCloud). The Terraform run also passes
with REGION=us-gov-west-1 and REGION=cn-north-1.
Names that end in .localhost (virtual-host S3, execute-api, lambda-url) resolve on macOS and on most Linux systems. They don't resolve in
Alpine Linux containers, which use a small C library without that rule. pogi doctor tells you which case you are in.
pogi registers 181 services: 131 AWS, 26 Google Cloud and 24 Azure. Each service name is followed by its registry id, the name pogi services prints.
AWS
| Service | Depth | Covered | Not yet |
|---|---|---|---|
S3 · s3 | Deep | buckets, objects, versioning, multipart, copy, tagging, ranges, conditional writes, presigned URLs and POST uploads, CORS, every Terraform GetBucket*, checksums (CRC32, CRC32C, CRC64NVME, SHA) and aws-chunked uploads, notifications to SQS, SNS, Lambda and EventBridge, bucket policies in enforcement (Allow and Deny, same and cross account, copy sources) and for anonymous callers, lifecycle rules applied by a sweep (current and noncurrent expiry, expired delete markers, aborted uploads, x-amz-expiration), Object Lock retention, legal hold and default retention enforced on delete and overwrite, static website hosting on <bucket>.s3-website.localhost (index and error documents) | stored replication settings are not acted on; lifecycle transitions are ignored; website routing rules are not applied; S3 Select; uploads over 10 MiB are refused unless --max-upload-mb is raised, because object bodies are held in memory (also in persistent mode) |
SQS · sqs | Deep | standard and FIFO, JSON and Query protocols, visibility, long polling, delays, DLQs and redrive (incl. message move tasks), batches, tags, attribute MD5s | |
SNS · sns | Deep | standard and FIFO topics; SQS, Lambda, HTTP, email and SMS (outbox) subscriptions; filter policies; raw delivery; platform applications | |
DynamoDB + Streams · dynamodb | Deep | every expression type, GSI/LSI (GSI keys with up to four HASH and four RANGE attributes), Query/Scan with paging, transactions, batches, TTL, streams with Lambda triggers, exact numbers, on-demand backups and restore (also to a point in time, from the current items), global table replicas that copy writes between regions | PartiQL, import/export; redundant parentheses in an expression are accepted (AWS refuses some) |
Lambda · lambda | Deep | CRUD, versions, aliases, layers, sync/async invoke, native Python/Node.js/custom runtimes or Docker, container images with ImageConfig, warm pool, reserved and provisioned concurrency with throttling, event source mappings (SQS, Kinesis, DynamoDB, and Amazon MSK clusters by ARN, and self-managed Kafka on any reachable broker) with batching windows, partial batch responses, bisecting and S3, SQS or SNS failure destinations, function URLs, hot reload, logs to CloudWatch, execution-role credentials, the Extensions API (INVOKE and SHUTDOWN events; extensions in a layer's extensions/ folder start with native and Docker runtimes) | Java/.NET/Ruby run only in Docker, code signing, SnapStart; Kafka and MSK mappings use plain or SASL connections (no TLS settings), and an MSK mapping needs its cluster ACTIVE with Docker; extensions do not delay an invocation and the Logs and Telemetry APIs are not served, and a container image's own /opt/extensions do not start; Architectures is stored but native functions run on the host architecture; failed async invokes retry after 1 and 2 seconds, where AWS waits 1 and 2 minutes, so tests stay fast; ListLayers refuses a CompatibleRuntime of an unknown family but accepts a mistyped version such as python3.99 |
API Gateway v1 + v2 · apigateway | Deep | REST and HTTP APIs, Lambda proxy (payload 1.0/2.0), HTTP proxy, mock, AWS integrations to Lambda and to other services (SQS, SNS, DynamoDB, Kinesis, Step Functions, S3 and more, with path and action URIs, request parameters and selectionPattern by status code), mapping templates in VTL (#set, #if, #foreach, $input, $util, $context, $stageVariables), custom domain names and base path mappings (REST, and HTTP with API mappings) reached by Host header or *.localhost, stage method settings (~1 and ~0 paths), Lambda/JWT/Cognito authorizers, API keys and usage plans, CORS, OpenAPI import (API key security, warnings, failonwarnings) | WebSocket invoke, VTL #macro, the role of an AWS integration (credentials) is not assumed, custom domain certificates are not checked and domains answer over HTTP only; AWS_IAM routes need a SigV4-signed request but the signature and the caller's permissions are not checked; a RestApi resource policy is enforced for Deny statements only (no implicit deny) |
Step Functions · stepfunctions | Deep | all state types, Retry/Catch, Map and Parallel, intrinsics, integrations with Lambda, SQS, SNS, DynamoDB, EventBridge and aws-sdk:*, callbacks, activities, .sync child executions, history, JSONata (Arguments, Output, Assign, Condition, $states, the built-in functions and the Step Functions ones, parsed at create) and state variables, JSONPath filters and .., state machine versions and aliases | distributed Map, redrive; Map ToleratedFailure* fields are checked at create but not applied (one failed item fails the Map); JSONata: $eval, $formatInteger, $parseInteger, the %, @ and # operators, and picture strings in $toMillis; by design, every real sleep (a Wait state or a Retry backoff) is cut to at most 60 seconds so local runs stay fast, so a Wait of an hour ends after one minute |
EventBridge + Scheduler · events, scheduler | Deep | buses, the full pattern syntax, targets, input transformers, archives and replay, connections and API destinations, schedules (at/rate/cron), Scheduler universal targets (aws-sdk:<service>:<action>) | EventBridge Pipes; a schedule with no Input delivers {} (AWS sends a default notification) |
Kinesis / Firehose · kinesis, firehose | Core | streams, shards, records, iterators, legacy CBOR, consumers with SubscribeToShard event streams (enhanced fan-out); Firehose buffering into S3 | |
CloudFormation · cloudformation | Deep | stacks, change sets, YAML/JSON, every intrinsic, conditions, rules, SSM parameter types, dynamic references, exports, nested stacks, custom resources, AWS::Include, the SAM transform (functions with Api, HttpApi, SQS, SNS, S3, Schedule, DynamoDB, Kinesis and EventBridge events, aliases, Globals, APIs, HTTP APIs, simple tables, layers, state machines), rollback that reverts in-place changes and keeps replaced resources until the update works, about 250 resource types (networking and EC2 instances, volumes and launch templates, ECS, load balancers, Auto Scaling, RDS and DocumentDB/Neptune clusters, ElastiCache, MemoryDB, Redshift, OpenSearch, Route 53, CloudFront, API Gateway, Cognito, AppSync, Glue, Athena, Backup, CodeBuild/CodePipeline/CodeDeploy, IoT, MQ, MSK, EKS and more, each created in its own service), plus any type an embedded service manages through Cloud Control (EFS, WAF, Config and others); a template with any other type is refused with a clear error; cdk bootstrap/deploy/destroy work | SAM connectors, applications and deployment preferences, StackSets and macros, drift detection (always in sync), types whose service has no API for them yet (SES receipt rules, RDS proxies, Logs resource policies and destinations, ECR replication, API Gateway accounts and VPC links, Glue workflows, VPN and peering connections) |
IAM · iam | Core | users, groups, roles, managed and inline policies, keys, instance profiles, OIDC/SAML providers, policy simulation, SSH public keys, service last-accessed reports, and enforcement (--iam soft/strict) of identity policies and permissions boundaries | resource-based policies other than S3 bucket policies and API Gateway resource policies, credential reports |
STS · sts | Core | GetCallerIdentity, AssumeRole (multi-account; the role must exist in IAM), web identity (an expired token is refused), session and federation tokens (DurationSeconds 900 or more; with signature checking on, expired credentials are refused) | trust policies are not checked, web identity tokens are not verified |
KMS · kms | Core | symmetric, RSA, ECC (incl. secp256k1 and Ed25519), ML-DSA and HMAC keys, aliases, encrypt/decrypt with context, data keys, sign/verify, MAC, rotation | grants, imported key material, multi-region keys |
Secrets Manager · secretsmanager | Core | versions and stages, rotation through Lambda, random passwords, batch get | replication (metadata only) |
Systems Manager (SSM) · ssm | Core | Parameter Store (String, StringList and SecureString types, paths, history, labels, public AMI parameters, /aws/), documents with versions, permissions and tags, associations, service settings, and Run Command (SendCommand runs shell documents with docker exec in the containers of running pogi EC2 instances, with statuses and GetCommandInvocation) | parameter policies; associations run once when made, not on their schedule; Run Command targets InstanceIds only (no tag targets), has one output stream, and runs aws:runShellScript steps only; Automation, Session Manager, Inventory and Patch Manager |
CloudWatch Logs · logs | Core | groups, streams, events, filter patterns, subscriptions, metric filters that publish to CloudWatch (a numeric or JSON $.field value, defaultValue, dimensions, unit; alarms on them fire), retention, Lambda logs, Insights (fields/) | Insights stats/parse; metric filters read JSON fields only (not space-delimited $name), and defaultValue is published per batch of ingested events, not per minute |
CloudWatch Metrics · cloudwatch | Core | metric data, statistics, metric math (basic), alarms with SNS/Lambda actions, CBOR/JSON/Query | composite alarm evaluation |
SES v1 + v2 · ses | Core | simple, raw and templated email, identities, outbox at /_aws/ses and in the console, configuration sets (v1 and v2) with event destinations to SNS, EventBridge (default bus) and CloudWatch (AWS/SES) that get Send, Delivery, Bounce and Complaint events, using the mailbox simulator addresses | Open, Click and Reject events; Firehose and Pinpoint destinations are stored but get nothing; the sandbox rule that a sender must be verified (any sender is accepted, on purpose) |
Cognito user pools · cognito-idp | Deep | pools, clients, groups, users, sign-up/confirm/forgot flows, USER_PASSWORD, SRP, REFRESH (with token rotation) and CUSTOM auth, choice-based USER_AUTH (password and email/SMS one-time codes), software token MFA with MFA_SETUP and a real TOTP check, identity providers shown on the login page, RS256 JWTs with JWKS and OpenID discovery, OAuth2 endpoints, Lambda triggers, password policy with history, account recovery setting, token validity limits | signing in through an external identity provider, passkeys (WEB_AUTHN), hosted-UI sign-up; a user whose MFA method was only switched on has no authenticator, so the code 123456 passes |
RDS / ElastiCache · rds, elasticache | Core | instances, clusters, subnet and parameter groups; real Postgres, MySQL, MariaDB, Redis, Valkey and Memcached containers with Docker | snapshot restore, read replicas, parameters applied to engines |
ECR · ecr | Deep | repositories and the image APIs on a real OCI registry: docker login/push/pull at localhost:4510 (a forwarding container on Docker Desktop, OrbStack and Colima), layer-upload APIs, lifecycle policies, canned scans; <account>.dkr.ecr.<region>.amazonaws.com/ images pull from it | one registry host for all accounts, blob garbage collection |
ECS · ecs | Deep | clusters, capacity providers, task definitions, tasks as containers (awsvpc via a shared network namespace, secrets from SSM/Secrets Manager, task-role credentials and metadata endpoints, awslogs to CloudWatch Logs, task volumes: host paths, shared Docker volumes and volumesFrom), services that keep their desired count, rolling deployments with aws.ecs events on the default bus, the deployment circuit breaker (a deployment whose tasks keep failing to start FAILS, with optional rollback), ALB registration | CPU shares, task sets, ECS Exec, EFS and FSx volumes |
ELB v2 · elbv2 | Deep | ALB/NLB/GWLB control plane; ALBs answer at http://<dns-name>:7644 (and on their listener port when free) with every rule condition, weighted and sticky forwards, redirects, fixed responses, Lambda targets and health checks; NLBs proxy TCP | authenticate-* actions, UDP, TLS termination on NLBs |
EC2 transit gateways, flow logs, hosts and images · ec2 | Core | transit gateways with VPC and peering attachments (peerings wait for accept) and the default route table links Terraform reads, flow logs with their LogFormat, dedicated hosts, EBS encryption by default (applied to new and root volumes), CreateImage (a docker commit of the instance container) and DeregisterImage, IAM instance profile associations, AssociateVpcCidrBlock (extra blocks take subnets), DescribeInstanceTypeOfferings | flow logs write no records, instances do not run on dedicated hosts, transit gateway route tables and routes, created images keep no snapshots (pogi has no EBS snapshots), IPv6 CIDR blocks on VPCs |
EKS · eks | Core | clusters as k3s containers: aws eks update-kubeconfig and kubectl work, with EKS-style token authentication and access entries; node groups, Fargate profiles, add-ons and pod identity as metadata | node groups add no nodes, version upgrades, a cluster endpoint other machines can reach (it is always https://127.0.0.1:<port>; pogi publishes container ports on loopback only) |
EC2 instances · ec2 | Core | instances as containers from an AMI catalog, UserData and cloud-config runcmd, IMDSv1/v2 with role credentials, reachable at 169.254.169.254 inside instances (an engine that shares the host network keeps only AWS_), ssh into an instance with a key pair (sshd is installed at boot with apk, apt-get, dnf or yum when the image has none), GetConsoleOutput, launch templates, security-group ports published, start/stop/terminate | |
Auto Scaling + Application Auto Scaling · autoscaling, application-autoscaling | Core | groups that keep their capacity, simple/step/target-tracking policies driven by CloudWatch alarms, scheduled actions, target-group registration; scalable targets for ECS, DynamoDB and Lambda | lifecycle hooks pause nothing, cooldowns |
Batch · batch | Core | compute environments, queues, job definitions, jobs as containers with retries, timeouts, arrays and dependencies, logs to CloudWatch | multi-node and EKS jobs |
CodeBuild · codebuild | Core | projects and builds that run real buildspecs in containers (phases, env from SSM and Secrets Manager, S3 sources, artifacts to S3, logs to CloudWatch) | privileged mode, caches, secondary sources, batch builds |
RDS extras · rds, rds-data | Deep | the Data API (typed parameters, JSON records, batches, real transactions) for Aurora PostgreSQL and MySQL; IAM database authentication through a Postgres/MySQL proxy that checks generate-db-auth-token tokens; snapshot copy (also from another region), snapshot modify, and point-in-time restore from dumps; TLS on the IAM proxy for Postgres with a leaf certificate from the local CA; DocumentDB (mongo:7), Neptune (Gremlin Server) and SQL Server engines | point-in-time restore uses current data, no TLS on MySQL (or on endpoints without IAM auth), MySQL IAM logins run as the master user, Data API arrays that hold NULL come back as text, Neptune openCypher/SPARQL |
ElastiCache users / MemoryDB · elasticache, memorydb | Core | users, user groups and ACLs applied to Redis/Valkey with ACL SETUSER; IAM authentication tokens through a RESP proxy; MemoryDB clusters on Valkey | MemoryDB IAM sign-in, TLS |
MSK · kafka | Core | provisioned and serverless clusters on Redpanda, bootstrap brokers for host and container clients, configurations and revisions, cluster operations | updates change metadata only, TLS/SCRAM/IAM listeners point at the plaintext one |
Amazon MQ · mq | Core | RabbitMQ and ActiveMQ brokers in containers with their users, consoles and endpoints, configurations and revisions, reboots | configuration data is not applied, no TLS endpoints |
OpenSearch Service · opensearch | Core | OpenSearch and legacy Elasticsearch domains in containers, reached at <domain>.<region>.opensearch.localhost:7644 with SigV4 stripped; config, versions, tags | upgrades, access policies, multi-node clusters |
Glue + Athena · glue, athena | Deep | Data Catalog databases, tables, partitions, crawlers (CSV/JSON schema inference), the Schema Registry (registries, schemas, versions that ignore custom Avro attributes, version metadata); Athena workgroups, named queries, prepared statements, DDL into Glue, and SELECTs run on DuckDB over the tables' S3 data, with results written to S3 | data is copied per query, no CTAS/INSERT/views, Parquet crawling |
Redshift + Data API + Serverless · redshift, redshift-data, redshift-serverless | Core | clusters and serverless workgroups on Postgres, the Data API (async statements, typed results, batches, catalog listing) with Redshift DDL clauses rewritten, temporary credentials that really log in; snapshot copy settings, copy grants and snapshot schedules as settings (nothing is copied or taken on a schedule) | parameters not applied, snapshots as metadata |
Timestream for InfluxDB · timestream-influxdb | Core | DB instances on InfluxDB 2 with the admin token in Secrets Manager | |
AppSync · appsync | Deep | GraphQL APIs with API key, Cognito, IAM, OIDC and Lambda auth; Lambda, DynamoDB, HTTP, NONE and RDS data sources; VTL and APPSYNC_JS resolvers, pipelines; subscriptions over the real-time WebSocket protocol with argument filters; introspection | sibling fields resolve serially, no caching, enhanced filters |
EventBridge Pipes · pipes | Deep | SQS, Kinesis and DynamoDB Streams sources with filters, Lambda/Step Functions/API destination enrichment, every async target, input templates, retries of failed batches | stream DLQs and partial batch failures, HttpParameters |
API Gateway WebSockets · apigateway | Core | WEBSOCKET APIs with route selection, $connect authorizers, two-way routes, @connections POST/GET/DELETE, integration and route responses | integration responses shape MOCK only |
Cognito identity pools · cognito-identity | Core | GetId, credentials for authenticated (user pools, OIDC, developer) and unauthenticated identities, role mappings, GetOpenIdToken | SAML and social tokens trusted unverified |
IoT Core · iot, iotdata | Core | things, groups, certificates, policies; an MQTT broker (TCP 1883 and WebSocket /mqtt), device shadows (classic and named), rules (SQL subset) to SQS, SNS, Lambda, DynamoDB, Kinesis, S3 and republish; the iotdata API | TLS client certificates, other rule actions |
Cloud Map · servicediscovery | Core | namespaces (private DNS ones create Route 53 zones with A/SRV records), services, instances, DiscoverInstances with filters, custom health; ECS service registries | Route 53 health checks |
CloudTrail · cloudtrail | Core | LookupEvents over every API call pogi serves, trails delivering gzipped logs to S3 and CloudWatch Logs, event selectors | events kept in memory only |
Fault Injection Service · fis | Core | templates and experiments injecting throttling, errors and latency per service, operation, role or Lambda function; stop conditions on CloudWatch alarms | target filters |
CodeDeploy + CodePipeline · codedeploy, codepipeline | Core | Lambda deployments with linear/canary traffic shifting, hooks and rollback; pipelines with S3 sources (a source with PollForSourceChanges set to true starts a run when the object changes), CodeBuild, CloudFormation, Lambda and approvals | change-set modes, ECS blue/green |
Organizations + SCPs, Verified Permissions, Resource Explorer · organizations, verifiedpermissions, resource-explorer-2 | Core | organizations, OUs, accounts, policies and their attachment; Cedar policy stores, schemas, templates and IsAuthorized (with Cognito tokens); indexes, views and search | SCPs don't restrict root; list operations return one page |
AppConfig · appconfig | Core | applications, environments, profiles, hosted versions with JSON Schema validators, deployments and strategies, the data plane (StartConfigurationSession and GetLatestConfiguration, as Ion text when Accept asks for it), feature flags, extensions | growth is not simulated |
CloudFront · cloudfront | Core | distributions served at <id>.cloudfront.localhost with behaviors, S3 and custom origins, cache and origin-request policies, functions (cloudfront-js), invalidations, OAC | signed URLs, viewer protocol policy |
S3 Vectors · s3vectors | Core | vector buckets, indexes, put/get/list/delete vectors, metadata filters, cosine and euclidean query | exact k-NN only |
SES SMTP · ses | Core | an SMTP server on port 2525 with SES SMTP credentials, mail into the console inbox, optional relay to Mailpit/MailHog | no retries or bounces |
| Long tail (generated) · 16 others | Core | 16 more services, beyond the rows above, emulated from their botocore models by one engine: create, describe, list, update, tags, paging, required-member checks and the models' own errors. AWS long-tail services walks every service built this way through create, get, list and delete, including some that also have a row above | per-service behavior beyond the services named in the other rows is bookkeeping |
IAM Identity Center · sso, sso-admin, sso-oidc, identitystore | Deep | aws sso login (device code and PKCE) with real portal credentials, permission sets and account assignments that create AWSReservedSSO_ roles, Identity Store users and groups | |
Security services · ram, wafv2, securityhub, detective, inspector2, macie2, accessanalyzer, network-firewall, cloudhsmv2, controltower, account | Core | RAM sharing with auto-accept in an organization, WAF v2 with lock tokens and capacity, Security Hub, Detective, Inspector, Macie, Access Analyzer, Network Firewall, CloudHSM, Control Tower, Account | no findings, no request filtering |
Transfer Family, DataSync, S3 Tables · transfer, datasync, s3tables | Deep | a real SFTP server (port 2222) on S3 with key auth and home-directory mappings; DataSync tasks that copy between S3 locations with filters; Iceberg table buckets with real metadata files and version tokens | FTPS, NFS/SMB transfers, the Iceberg REST catalog |
AWS Backup · backup | Core | vaults, plans, selections, tags; backup jobs that run to COMPLETED and make recovery points (in any account, resumed after a restart), vault notifications to SNS | scheduled plan runs, restore jobs, cross-account copy |
Config, Managed Prometheus, RUM, OAM · config, amp, rum, oam | Core | Config recorders, rules and evaluations; Prometheus remote write with a PromQL subset (selectors, rate, sum by) | binary operators, custom Config rules |
Cloud Control API · cloudcontrol | Deep | create, read, update (JSON Patch) and delete through CloudFormation's own resource handlers, or the generated engine's | ListResources finds resources made outside Cloud Control only for queues and log groups; other types list what Cloud Control made |
Beanstalk, EMR, MWAA, Flink, Lightsail, DMS, Lake Formation, Connect · elasticbeanstalk, emr, emr-serverless, mwaa, kinesisanalyticsv2, lightsail, dms, lakeformation, connect | Core | lifecycles that settle (Launching → Ready, STARTING → WAITING, ...), Lake Formation permissions and LF-tags; with Docker, MWAA runs the official apache/airflow image (standalone, DAGs synced from the S3 path, configuration options, requirements.txt, plugins zip and startup script applied, UpdateEnvironment runs it again with the new settings) behind the web server host and the Airflow CLI endpoint, and Managed Flink runs the application's JAR from S3 on a real apache/flink cluster with the runtime properties, AWS credentials and the pogi endpoint (the application is READY again when its job ends by itself); with saved state, Flink applications that were RUNNING and MWAA environments that were up start again after a pogi restart | without Docker nothing runs (statuses only; the CLI endpoint says so); older Flink versions run under emulation on Apple Silicon (only 1.20 has an arm64 image); the Airflow web UI has no login; installing requirements needs internet access in the container; the requirements.txt object version is not used (the latest object is read); the other services here run nothing |
Bedrock and the AI services · bedrock, bedrock-agent, bedrock-agent-runtime, bedrock-agentcore, bedrock-agentcore-control, bedrock-runtime, sagemaker, sagemaker-runtime, comprehend, translate, textract, transcribe, rekognition | Deep | a local model gateway (any OpenAI-compatible endpoint, else stable canned answers): Bedrock InvokeModel in every common body format, Converse and both streaming APIs, embeddings, agents and knowledge bases; SageMaker endpoints; Comprehend and Translate through the model; Textract, Transcribe and Rekognition with deterministic results | guardrails are not evaluated, agents don't call action groups |
Cost services · pricing, ce, budgets, cur, bcm-data-exports, bcm-pricing-calculator, meteringmarketplace | Core | an embedded price list (Pricing API); Cost Explorer and Budgets computed from what pogi actually ran, with budget alerts to SNS; CUR and data exports written to S3; Pricing Calculator; Marketplace metering | storage and Lambda-duration billing |
ACM, Route 53, EC2 network, Tagging · acm, route53, ec2, resourcegroupstaggingapi | Thin | certificates, hosted zones and records, VPCs/subnets/security groups with a default VPC, route tables and routes, internet and egress-only gateways, Elastic IPs, NAT gateways (with their Elastic IP and network interface), network interfaces (instances show theirs), VPC endpoints (gateway routes, interface addresses), AWS and managed prefix lists, network ACLs and entries, tagging across services (queues, log groups, rules, API keys, functions, tables and more) | ACM certificates are issued at once, also with EMAIL validation (no approval step); network ACL and route rules do not filter traffic; DescribeVpcEndpointServices, peering connections as resources |
Google Cloud
| Service | Depth | Covered | Not yet |
|---|---|---|---|
Cloud Storage · gcs | Deep | buckets, objects, media/multipart/resumable uploads, generations and preconditions, compose/rewrite/copy, signed URLs, notifications to Pub/Sub | IAM conditions, retention policies |
Pub/Sub · pubsub | Deep | gRPC and REST, pull, streaming pull, push, ack deadlines, ordering keys, filters, dead-letter, retry, seek and snapshots, schemas that topics enforce on publish (Avro and Protocol Buffers, JSON or binary encoding; ValidateMessage uses the same check) | exactly-once, BigQuery/GCS subscriptions; the schema check says only that a message failed validation, Avro JSON ignores fields the schema does not name, and Protocol Buffers definitions cannot import other files |
Firestore (Native) · firestore | Deep | documents, subcollections, queries with cursors and collection groups, aggregations, transactions, batches, transforms, realtime listeners, read_time | vector search, security rules |
Firestore (Datastore mode) · datastore | Core | gRPC and REST: lookups, queries (filters, composite AND/OR, orders, projections, distinct on, ancestors, namespaces, cursors, offset, limit), count/sum/avg aggregations, optimistic transactions, property masks and transforms, allocateIds, reserveIds, POST /reset; DATASTORE_ | GQL, read_time, metadata queries (__kind__), index checks |
Cloud SQL · sqladmin | Core | v1beta4 and v1 REST API: instances on real PostgreSQL, MySQL and SQL Server containers, databases and users created in the engine, SSL certs, operations, flags, tiers, clone, SQL export/import through Cloud Storage, connectSettings, generateEphemeralCert; the address is 127.0.0.1:<port> | Auth Proxy, TLS and IAM database auth, CSV/BAK, replicas, backups, failover |
Secret Manager · secretmanager | Core | secrets, versions (enable, disable, destroy), aliases, checksums, etags | rotation and notifications (stored only) |
Cloud Run · run | Core | v2 API (gRPC and REST): services, revisions, traffic splits and tags, jobs and executions; containers on <svc>.run.localhost, started on the first request; Hub.Deliver target | worker pools, tasks API, sidecars, scaling, secrets and volumes |
BigQuery · bigquery | Core | datasets, tables with nested and repeated schemas, partitioning and clustering (stored), views, streaming inserts, tabledata.list, jobs (query, load from Cloud Storage as CSV, JSON lines and Parquet, extract, copy); SQL on DuckDB in a container (GoogleSQL translated: backtick names, SAFE_CAST, STRUCT/ARRAY, UNNEST, common functions, DML, DDL, scripts) | needs Docker for queries; no WITH OFFSET, wildcard tables, INFORMATION_, ML, Storage API, partition pseudo-columns |
Cloud Logging · logging | Core | write, list (the query language: severity, resource, labels, payload fields, regex, time, AND/OR/NOT), tail, logs; sinks to Pub/Sub, Cloud Storage and BigQuery; exclusions; log-based metrics (stored); buckets; Cloud Run, Cloud Functions and Run jobs output | views, links, analytics, log scopes |
Cloud Monitoring · monitoring | Core | custom metric descriptors, CreateTimeSeries, ListTimeSeries with filters, alignment and cross-series reduction; resource descriptors; alert policies, notification channels and uptime checks (stored only) | MQL/PromQL, groups, services and SLOs, snoozes, built-in metrics |
Cloud Functions · cloudfunctions | Core | v2 API (gRPC and REST): Python functions on the Functions Framework (native or in Docker), HTTP and Pub/Sub triggers, generateUploadUrl, Hub.Deliver target for Eventarc | Node, Go and other runtimes, repository sources, IAM |
Cloud Tasks · cloudtasks | Core | queues with rate limits and retry config, HTTP tasks with OIDC/OAuth tokens, dispatch with backoff, pause/resume/purge, RunTask, task-name tombstones | App Engine tasks, queue-level HTTP overrides |
Cloud Scheduler · cloudscheduler | Core | jobs on unix-cron schedules with time zones, HTTP (with OIDC/OAuth) and Pub/Sub targets, retries, pause/resume/run | App Engine targets, cron macros |
Eventarc · eventarc | Core | triggers on Cloud Storage object events and Pub/Sub messages, delivering CloudEvents to Cloud Run, Cloud Functions and HTTP endpoints | audit-log triggers, retries of failed deliveries, Workflows destinations |
Managed Kafka · managedkafka | Core | clusters (one Redpanda broker each with Docker), topics, consumer groups read from the broker; the local bootstrap address in the pogi-bootstrap label | ACLs, replication |
IAM, IAM Credentials, OAuth2, STS · gcpiam, iamcredentials, gcpoauth | Core | service accounts with real key files (token_uri pointing at pogi), custom and predefined roles, policies; access and ID tokens, signBlob/signJwt, public keys at the metadata endpoints and /oauth2/v3/certs; the token endpoint for key files, user ADC and workload identity federation | IAM is not enforced, a sample of predefined roles |
Resource Manager, Service Usage · resourcemanager, serviceusage | Core | projects (v1 and v3), folders and organizations (read-only), project IAM policies; enabling and listing services | bookkeeping only |
Cloud KMS · cloudkms | Deep | key rings, keys and versions with real cryptography: AES-GCM with AAD and CRC32C, RSA and EC signing, RSA decryption, HMAC, rotation, scheduled destruction, generateRandomBytes | raw encryption, import jobs, ED25519 and post-quantum keys |
Firebase Auth · firebaseauth | Core | the Identity Toolkit and emulator APIs: email/password, anonymous, custom-token and fake-IdP sign-in, refresh, custom claims, OOB codes in the console inbox; Admin SDK VerifyIDToken in emulator mode | tenants, MFA, email-link sign-in |
Kubernetes Engine · container | Core | container.googleapis.com v1 and v1beta1 (gRPC and REST): clusters and node pools with GKE's own operations; each cluster is a real k3s API server, PROVISIONING until its node is Ready, with endpoint and masterAuth.clusterCaCertificate; kubectl works with a kubeconfig from pogi kubeconfig gke <cluster> or gcloud container clusters get-credentials (the API server accepts pogi's own ya29.pogi-… tokens); without Docker, metadata only | node pools are metadata and add no nodes, one Kubernetes version (the k3s one), every valid token is cluster-admin, lists are one page |
Compute Engine · compute | Core | the REST API at /compute/ (google.golang.org/, cloud.google.com/, gcloud, Terraform): zones, regions, machine types and images as static lists; instances (insert, get, list, delete, start, stop, reset, setMetadata, setLabels), disks, networks, subnetworks, firewalls and addresses; operations are DONE when returned; instances run as containers of their boot image (debian, ubuntu, cos) with startup-script metadata run at every boot, and the metadata server at /computeMetadata/ (project, zone, attributes, service-account tokens, ?recursive and ?alt=json) reached through GCE_; without Docker, metadata only | live migration, snapshots, instance templates, groups, load balancing, custom images; networks carry no traffic and firewall rules are only stored; startup-script-url and shutdown scripts; instances share the host's ports on engines without a VM |
Artifact Registry · artifactregistry | Core | v1 (gRPC and REST): repositories (create, get, list, update, delete, IAM) and Docker images on ECR's OCI registry: docker push and pull at localhost:4510/, and <region>-docker.pkg.dev/ references run by Cloud Run, ACI and the like are pulled from it; without Docker, metadata only | formats other than Docker (stored as metadata), packages, versions, tags, files and rules, dockerImages.get |
Long-running operations · operations | Core | the shared google.longrunning.Operations service every GCP method that returns an Operation uses: get, list, wait, cancel and delete, over gRPC and REST (/v1|v2/) | operations are in memory only and never expire |
Azure
| Service | Depth | Covered | Not yet |
|---|---|---|---|
Blob Storage · azblob | Deep | containers, block, append and page blobs, block lists, ranges, metadata, copy, leases, tags (Azurite port 10000) | |
Queue Storage · azqueue | Core | messages: put, get, peek, update, delete, visibility, TTL (port 10001) | |
Table Storage · aztable | Core | entities with typed properties, upsert/merge/replace, $filter/, continuation, $batch (port 10002) | $filter functions, Atom payloads |
Cosmos DB (NoSQL) · cosmos | Core | databases, containers, items, patch, the SQL dialect (joins, subqueries, GROUP BY, functions), transactional batch, change feed, TTL, offers | stored procedures run nothing, .NET binary batches, spatial/vector functions |
Key Vault · keyvault | Core | secrets (versions, soft delete, recover, purge, backup) and keys (RSA/EC/oct crypto, wrap, sign, rotate); self-signed certificates | certificate issuers, key release |
Service Bus · servicebus | Deep | AMQP (port 5672) with the official SDK: queues, topics, subscriptions with SQL and correlation rules and actions, peek-lock and receive-and-delete, sessions with state, dead-letter, defer, schedule, lock renewal, duplicate detection, forwarding, TTL; the admin (ATOM) API | auto-delete-on-idle and max size are stored only |
Event Hubs · eventhubs | Deep | AMQP with the official SDK: partitions, keys, start positions, epochs, $management properties, the Processor with Blob checkpoints; a Kafka endpoint on Redpanda with Docker | AMQP and Kafka are separate logs, fixed partition count |
Event Grid · eventgrid | Core | custom topics, domains, Blob system topics; subscriptions with filters delivering to webhooks (with the validation handshake), Service Bus, Event Hubs, Storage queues and Functions in Event Grid or CloudEvents schema; retries and dead-letter to Blob | hybrid connections, input schema mapping |
Azure Functions · azfunctions | Core | apps run by the real Functions host (Core Tools or the official image) on pogi's Storage: HTTP, timer, queue and Event Grid triggers, zip deploy | Kudu beyond zip deploy, requirements.txt in containers |
App Configuration · azappconfig | Core | key-values with labels, filters, ETags, locks, revisions, snapshots, feature flags; HMAC auth | |
SignalR, Communication Services email · signalr, azemail | Core | SignalR negotiate, WebSocket JSON hub protocol and server REST API (users, groups, connections); Communication Services email into the console inbox | SignalR upstreams, SSE and MessagePack |
Resource Manager, Entra ID, Managed Identity, Graph · arm, entra, graph | Core | the ARM control plane (metadata endpoint, subscriptions, resource groups, providers, async operations, deployments as metadata, generic resources); Entra tokens for client secrets and assertions, passwords, refresh and device code with JWKS; IMDS and App Service managed identity; Graph applications, service principals, users and groups | templates are not run (a deployment whose template holds an unknown resource type ends Failed), a PUT of a resource type pogi does not know is refused (InvalidResourceType, or NoRegisteredProviderFound for an unknown namespace), Graph covers what azuread and az ad use |
Management planes (ARM) · arm | Core | ARM resources for storage accounts, Key Vault, Cosmos DB, Service Bus, Event Hubs, Event Grid, Functions, App Configuration, SignalR and Communication Services, wired to their data planes; the azurerm Terraform provider applies, plans clean and destroys (run in Docker on macOS) | storage regenerateKey, function app config sub-resources |
Azure SQL, PostgreSQL, MySQL, MariaDB, Cache for Redis · azdatabases | Core | servers, databases and firewall rules as real engines in containers; Redis keys that work as AUTH passwords | configurations are not applied, no TLS |
Azure Monitor · azmonitor | Core | Log Analytics workspaces, data collection rules and endpoints, the Logs Ingestion API with KQL transforms, the query API with a KQL subset (where, project, extend, summarize, order, top, let and more), Application Insights requests and traces | joins, unions and parse, real metrics |
Virtual Network · aznetwork | Core | virtual networks and subnets with address checks, NSGs and rules, public IPs, NICs with private IP allocation, route tables, NAT gateways, private DNS zones | no traffic, peerings or service endpoints |
API Management · apim | Core | the management plane (services, APIs with operations, policies and schemas, backends, products with their APIs and policies, subscriptions with primary and secondary keys and listSecrets, named values, the service-level policy) and the gateway at <service>.azure-api.localhost:7644/ or /_azure/: API and operation matching by path, method and URL template, subscription keys, policies in order service → product → API → operation with <base/>, forwarding to the backend; policies set-header, set-query-parameter, rewrite-uri, set-backend-service, rate-limit, rate-limit-by-key, validate-jwt (pogi's Entra tokens work), return-response, mock-response, cors, set-body | OpenAPI and WSDL import, the C# policy expression language (a few context.Request.Headers forms only), other policies (choose, send-request, quota, caching, retry) are skipped, on-error sections, rate limits are a fixed window kept in memory |
Kubernetes Service · azaks | Core | ARM Microsoft.ContainerService/managedClusters and agentPools: each cluster is a real k3s API server, Creating until its node is Ready, with fqdn; listClusterUserCredential and listClusterAdminCredential return a kubeconfig whose token the API server accepts (the armcontainerservice client and az aks get-credentials); without Docker, Succeeded at once with no API server | agent pools are metadata and add no nodes, one Kubernetes version, a static bearer token instead of Entra tokens (no kubelogin) |
Container Registry · azacr | Core | ARM Microsoft.ContainerRegistry/registries on ECR's OCI registry: <name>.azurecr.localhost:4510 or localhost:4510/, docker push and pull, listCredentials, and the sign-in endpoints of az acr login and /oauth2/exchange; ACI and Container Apps pull images from it; without ECR, metadata only | credentials are issued but never checked (the registry accepts any, anonymous included) |
Container Instances · azaci | Core | ARM Microsoft.ContainerInstance/containerGroups: containers in Docker with image, command, environment, ports, CPU and memory limits and restart policy; the group's IP address and dnsNameLabel served at <label>.<location>.azurecontainer.localhost:7644 and /_azure/; instanceView states, start, stop, restart and container logs; without Docker, groups stay Pending | exec and attach, volumes, probes, GPUs, virtual networks, init containers, identities |
Container Apps · azcontainerapps | Core | ARM Microsoft.App/managedEnvironments, containerApps (with revisions) and jobs (with executions): apps as containers behind ingress at <app>.<env>.azurecontainerapps.localhost:7644, started on the first request like Cloud Run; a revision per template change, traffic weights in Multiple mode; secrets and env; jobs run on the start action with parallelism, retries and timeouts; without Docker, metadata only | the first container of a template only (no sidecars or init containers), one replica per revision and no scaling (settings are stored), volumes, probes, Dapr, custom domains, schedule and event triggers of jobs never fire |
Virtual Machines · azcompute | Core | ARM Microsoft.Compute/virtualMachines, disks, availabilitySets and sshPublicKeys: VMs as containers of the base image their image reference names (Ubuntu, Debian), customData run at first boot (a cloud-config runcmd subset or a script), instanceView power state, start, powerOff, deallocate and restart, NIC private IPs from the Virtual Network service, and the instance metadata service (/metadata/ and identity tokens) reachable from inside; Windows and other images, and Docker-less runs, are metadata only | extensions, scale sets, images, snapshots, run commands, ssh into the VM, other cloud-config modules, GET …/instanceView (the view is part of every GET) |