localstack · quetzalliwrites · Sep 9, 2026 · mmaureenliu · Sep 10, 2026 · nik-localstack
@@ -377,10 +377,10 @@ AWS_PROFILE=ls-sandbox aws ssm get-parameters --names myparam
 
 The SSM parameter has the ARN: `arn:aws:ssm:eu-central-1:<account-id>:parameter/myparam`.
 
-Next, we can check that the parameter is not present in LocalStack using `awslocal`:
+Next, we can check that the parameter is not present in LocalStack using `lstk aws`:
 
 ```bash
-awslocal ssm get-parameters --name myparam
+lstk aws ssm get-parameters --name myparam
 ```
 
 ```json showLineNumbers
@@ -435,7 +435,7 @@ The state is `SUCCEEDED`, indicating the replication job completed successfully.
 The SSM parameter is now accessible.
 
 ```bash
-awslocal ssm get-parameters --name myparam --region eu-central-1
+lstk aws ssm get-parameters --name myparam --region eu-central-1
 ```
 
 ```json showLineNumbers

@@ -153,12 +153,12 @@ We will add an SCP that denies the action and confirm that the request is blocke
 In **Terminal 1**, create an organization and a service control policy that denies `s3:CreateBucket`:
 
 ```bash
-awslocal organizations create-organization --feature-set ALL
+lstk aws organizations create-organization --feature-set ALL
 ```
 
 
 ```bash
-awslocal organizations create-policy \
+lstk aws organizations create-policy \
     --name deny-create-bucket \
     --type SERVICE_CONTROL_POLICY \
     --description "Deny S3 bucket creation" \
@@ -168,15 +168,15 @@ awslocal organizations create-policy \
 Attach the SCP to the target account:
 
 ```bash
-awslocal organizations attach-policy \
+lstk aws organizations attach-policy \
     --policy-id <POLICY_ID> \
     --target-id <TARGET_ID>
 ```
 
 Back in **Terminal 2**, attempt to create the bucket again as user `test`:
 
 ```bash
-awslocal s3 mb s3://mybucket
+lstk aws s3 mb s3://mybucket
 ```
 
 Even though the user's identity-based policy allows `s3:CreateBucket`, the SCP guardrail blocks the request, and the denial message names the responsible SCP:

@@ -23,7 +23,7 @@ Unlike [IAM Policy Enforcement](/aws/developer-tools/security-testing/iam-policy
 
 ## Getting started
 
-This guide is designed for users new to the IAM Policy Simulator and assumes basic knowledge of the AWS CLI and our [`awslocal`](https://github.com/localstack/awscli-local) wrapper script.
+This guide is designed for users new to the IAM Policy Simulator and assumes basic knowledge of the AWS CLI and our [`lstk aws`](/aws/developer-tools/running-localstack/lstk/cloud-and-iac-commands/#aws) command.
 
 Start your LocalStack container using your preferred method.
 
@@ -32,17 +32,17 @@ Start your LocalStack container using your preferred method.
 Create a user and attach a policy that only allows `s3:CreateBucket`:
 
 ```bash
-awslocal iam create-user --user-name test-user
+lstk aws iam create-user --user-name test-user
 ```
 
 ```bash
-awslocal iam create-policy \
+lstk aws iam create-policy \
     --policy-name allow-create-bucket \
     --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:CreateBucket","Resource":"*"}]}'
 ```
 
 ```bash
-awslocal iam attach-user-policy \
+lstk aws iam attach-user-policy \
     --user-name test-user \
     --policy-arn arn:aws:iam::000000000000:policy/allow-create-bucket
 ```
@@ -52,7 +52,7 @@ awslocal iam attach-user-policy \
 Use `simulate-principal-policy` to check whether `test-user` can create and delete an S3 bucket, without actually calling S3:
 
 ```bash
-awslocal iam simulate-principal-policy \
+lstk aws iam simulate-principal-policy \
     --policy-source-arn arn:aws:iam::000000000000:user/test-user \
     --action-names s3:CreateBucket s3:DeleteBucket \
     --resource-arns "*"

@@ -23,7 +23,7 @@ There are three common ways to use LocalStack in AI-assisted development:
 
 - Use the [LocalStack MCP Server](/aws/developer-tools/running-localstack/mcp-server/) when your AI assistant supports MCP clients such as Cursor, Claude, Codex, or OpenCode.
 - Use [LocalStack Skills](https://github.com/localstack/skills) when you want reusable agent instructions for deploying and testing AWS architectures against LocalStack.
-- Use LocalStack with `tflocal`, `cdklocal`, or `awslocal` when you want the agent to generate infrastructure code or commands that you review and run locally.
+- Use LocalStack with `lstk terraform`, `lstk cdk`, or `lstk aws` when you want the agent to generate infrastructure code or commands that you review and run locally.
 
 You do not need all three approaches to get started. If your editor supports MCP, start with the LocalStack MCP Server. Or, you can use Skills if you want reusable agent instructions. If not, ask your assistant to generate Terraform, CDK, or AWS CLI steps and run them with LocalStack's local wrappers.
 
@@ -72,7 +72,7 @@ After LocalStack and your preferred AI tooling are configured, you can use a seq
 
 ```text
 Create a Terraform application with an S3 bucket, a Lambda function, and a DynamoDB table.
-Make it deployable to LocalStack with tflocal.
+Make it deployable to LocalStack with lstk terraform.
 ```
 
 ```text

@@ -19,7 +19,7 @@ A typical CI job with LocalStack follows this flow:
 1. Check out your application code.
 2. Start LocalStack in the CI runner.
 3. Configure a CI Auth Token through the CI provider's secret manager.
-4. Deploy test infrastructure with tools such as `awslocal`, `tflocal`, `cdklocal`, or your application's test harness.
+4. Deploy test infrastructure with the [`lstk`](/aws/developer-tools/running-localstack/lstk/) CLI proxies (`lstk aws`, `lstk terraform`, `lstk cdk`, `lstk sam`) or your application's test harness.
 5. Run integration tests against the LocalStack endpoint.
 6. Collect logs, test reports, and artifacts from the job.
 
@@ -49,11 +49,11 @@ For brevity, these snippets show only the LocalStack startup shape. Apart from t
   <TabItem label="GitHub Actions">
 
     ```yaml
+    - name: Install lstk
+      run: npm install -g @localstack/lstk
+
     - name: Start LocalStack
-      uses: LocalStack/setup-localstack@main
-      with:
-        image-tag: 'latest'
-        install-awslocal: 'true'
+      run: lstk start
       env:
         LOCALSTACK_AUTH_TOKEN: ${{ secrets.LOCALSTACK_AUTH_TOKEN }}
     ```
@@ -65,27 +65,18 @@ For brevity, these snippets show only the LocalStack startup shape. Apart from t
 
     ```yaml
     version: '2.1'
-    orbs:
-      python: circleci/python@4.0.0
     jobs:
       localstack-test:
         machine:
           image: ubuntu-2204:current
         steps:
           - checkout
           - run:
-              name: Install lstk and awslocal
-              command: |
-                python3 -m pip install --user --upgrade pip
-                python3 -m pip install --user localstack awscli-local[ver1]
-                echo 'export PATH=$HOME/.local/bin:$PATH' >> "$BASH_ENV"
+              name: Install lstk
+              command: npm install -g @localstack/lstk
           - run:
               name: Start LocalStack
-              command: |
-                source "$BASH_ENV"
-                docker pull localstack/localstack:latest
-                localstack start -d
-                localstack wait -t 60
+              command: lstk start
     ```
 
     See the [CircleCI guide](/aws/ci-pipelines/circleci/) for the full setup.
@@ -94,7 +85,7 @@ For brevity, these snippets show only the LocalStack startup shape. Apart from t
   <TabItem label="Bitbucket">
 
     ```yaml
-    image: python:3.9
+    image: node:22
 
     definitions:
       services:
@@ -108,12 +99,11 @@ For brevity, these snippets show only the LocalStack startup shape. Apart from t
             services:
               - docker
             script:
-              - export DOCKER_SOCK=$DOCKER_HOST
-              - export AWS_ENDPOINT_URL="http://localhost.localstack.cloud:4566"
+              - export LSTK_ENDPOINT_URL="http://localhost.localstack.cloud:4566"
               - echo "${BITBUCKET_DOCKER_HOST_INTERNAL} localhost.localstack.cloud " >> /etc/hosts
-              - pip install localstack awscli-local
-              - docker run -d --rm -p 4566:4566 -p 4510-4559:4510-4559 -e DOCKER_SOCK=tcp://${BITBUCKET_DOCKER_HOST_INTERNAL}:2375 -e DOCKER_HOST=tcp://${BITBUCKET_DOCKER_HOST_INTERNAL}:2375 --name localstack-main localstack/localstack
-              - localstack wait -t 60
+              - npm install -g @localstack/lstk
+              - docker run -d --rm -p 4566:4566 -p 4510-4559:4510-4559 -e LOCALSTACK_AUTH_TOKEN=${LOCALSTACK_AUTH_TOKEN:?} -e DOCKER_SOCK=tcp://${BITBUCKET_DOCKER_HOST_INTERNAL}:2375 -e DOCKER_HOST=tcp://${BITBUCKET_DOCKER_HOST_INTERNAL}:2375 --name localstack-aws localstack/localstack-pro
+              - lstk aws s3 mb s3://test-bucket
     ```
 
     See the [Bitbucket Pipelines guide](/aws/ci-pipelines/bitbucket/) for the full setup.
@@ -125,12 +115,15 @@ For brevity, these snippets show only the LocalStack startup shape. Apart from t
     version: 0.2
 
     phases:
+      install:
+        runtime-versions:
+          nodejs: 22
+        commands:
+          - npm install -g @localstack/lstk
       pre_build:
         commands:
-          - pip3 install localstack awscli
-          - docker pull public.ecr.aws/localstack/localstack:latest
-          - localstack start -d
-          - localstack wait -t 30
+          - lstk setup aws
+          - lstk start
     ```
 
     See the [CodeBuild guide](/aws/ci-pipelines/codebuild/) for the full setup.
@@ -139,27 +132,24 @@ For brevity, these snippets show only the LocalStack startup shape. Apart from t
   <TabItem label="GitLab CI">
 
     ```yaml
-    stages:
-      - test
+    image: node:22
 
-    variables:
-      DOCKER_HOST: tcp://docker:2375
-      DOCKER_TLS_CERTDIR: ""
-      LOCALSTACK_HOST: "localstack:4566"
-
-    services:
-      - name: localstack/localstack:latest
-        alias: localstack
-      - name: docker:dind
-        alias: docker
-        command: ["--tls=false"]
-
-    localstack-test:
-      stage: test
-      image: python:3.11
+    stages:
+      - job
+
+    job:
+      stage: job
+      variables:
+        DOCKER_HOST: tcp://docker:2375
+        DOCKER_TLS_CERTDIR: ""
+        LOCALSTACK_AUTH_TOKEN: $LOCALSTACK_AUTH_TOKEN
+        LOCALSTACK_HOST: localhost.localstack.cloud:4566
+      services:
+        - name: docker:dind
       script:
-        - pip install awscli-local
-        - awslocal s3 mb s3://test-bucket
+        - npm install -g @localstack/lstk
+        - lstk start
+        - lstk aws s3 mb s3://test-bucket
     ```
 
     See the [GitLab CI guide](/aws/ci-pipelines/gitlab-ci/) for the full setup.
@@ -168,19 +158,18 @@ For brevity, these snippets show only the LocalStack startup shape. Apart from t
   <TabItem label="Travis CI">
 
     ```yaml
-    language: python
+    language: node_js
+
+    node_js:
+      - "22"
 
     services:
       - docker
 
-    python:
-      - "3.8"
-
     before_install:
-      - python -m pip install localstack awscli-local[ver1]
-      - docker pull localstack/localstack
-      - localstack start -d
-      - localstack wait -t 30
+      - npm install -g @localstack/lstk
+      - lstk setup aws
+      - lstk start
     ```
 
     See the [Travis CI guide](/aws/ci-pipelines/travis-ci/) for the full setup.

@@ -286,7 +286,7 @@ LocalStack exposes two log-related environment variables:
 For a startup issue, set both:
 
 ```shell
-DEBUG=1 LS_LOG=trace localstack start
+DEBUG=1 LS_LOG=trace lstk start
 ```
 
 Or via Docker Compose:
@@ -656,7 +656,7 @@ To speed up your ticket, attach:
    ```
 
 3. LocalStack image tag — `docker inspect <container> --format '{{.Config.Image}}'`.
-4. CLI version — `localstack --version`.
+4. CLI version — `lstk --version`.
 5. Host OS, architecture, and Docker runtime (Docker Desktop, Colima, Rancher, Podman, Linux native).
 6. Output of:
 

@@ -49,7 +49,7 @@ When the container is ready, you will see the following logs:
 
 ## Step 2: Deploy the serverless API
 
-You can deploy the Lambda function and DynamoDB table using either our AWS CLI wrapper `lstk aws` or our Terraform wrapper `tflocal`.
+You can deploy the Lambda function and DynamoDB table using either our AWS CLI wrapper `lstk aws` or our Terraform wrapper `lstk terraform`.
 These tools automatically route AWS API calls to your LocalStack container, so you do not need AWS account credentials for this guide.
 
 <Tabs>

@@ -19,8 +19,8 @@ Before starting, make sure you have the following:
 - A [LocalStack Auth Token](https://docs.localstack.cloud/getting-started/auth-token/) exported as `LOCALSTACK_AUTH_TOKEN`
 - [Docker](https://docs.docker.com/get-docker/)
 - [`kind`](https://kind.sigs.k8s.io/)
-- [Terraform](https://www.terraform.io/downloads) (v1.11.1 or later) with the [`tflocal`](https://docs.localstack.cloud/user-guide/integrations/terraform/) wrapper
-- [AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) with the [`awslocal`](https://docs.localstack.cloud/user-guide/integrations/aws-cli/#localstack-aws-cli-awslocal) wrapper
+- [Terraform](https://www.terraform.io/downloads) (v1.11.1 or later) and [`lstk terraform`](/aws/connecting/infrastructure-as-code/terraform#lstk-terraform)
+- [AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) and [`lstk aws`](/aws/developer-tools/running-localstack/lstk/cloud-and-iac-commands/#aws)
 - [`kubectl`](https://kubernetes.io/docs/reference/kubectl/)
 - [`jq`](https://jqlang.github.io/jq/download/)
 - [`k9s`](https://k9scli.io/) (optional, for visual cluster monitoring)
@@ -118,7 +118,7 @@ kubectl port-forward -n workspace svc/localstack-env-1 4566
 This runs in the foreground. Open a new terminal for the remaining steps. Verify LocalStack is accessible:
 
 ```bash
-awslocal sts get-caller-identity
+lstk aws sts get-caller-identity
 ```
 
 You can also confirm connectivity using the [LocalStack Web Application](https://app.localstack.cloud/inst/default/overview).
@@ -136,8 +136,8 @@ The Terraform configuration provisions the following resources on LocalStack:
 Both the database and Lambda function run as separate pods in the cluster, managed by LocalStack's Kubernetes executor.
 
 ```bash
-tflocal init -upgrade
-tflocal apply -auto-approve
+lstk terraform init -upgrade
+lstk terraform apply -auto-approve
 ```
 
 The deployment takes a few minutes as the MySQL pod needs to start up. Monitor progress with `k9s` or:
@@ -153,7 +153,7 @@ The Lambda module is configured for ARM64 by default. If you are on an Intel/AMD
 ### Step 7: Invoke the Lambda function
 
 ```bash
-awslocal lambda invoke \
+lstk aws lambda invoke \
     --function-name myfunction \
     --payload '{}' /dev/stdout | jq .
 ```
@@ -191,7 +191,7 @@ You should see the LocalStack pod (`localstack-*`), the MySQL database pod (`ls-
 To tear down all resources:
 
 ```bash
-tflocal apply -destroy -auto-approve
+lstk terraform apply -destroy -auto-approve
 kubectl delete -f ./localstack-instance.yml
 kubectl delete secret -n workspace localstack-auth-token
 ```
@@ -201,14 +201,14 @@ kubectl delete secret -n workspace localstack-auth-token
 ### LocalStack pod is stuck in `Pending` or `ImagePullBackOff`
 Verify that your Auth Token secret was created correctly and that your cluster nodes can pull from the LocalStack registry. Check pod events with `kubectl describe pod -n workspace <pod-name>`.
 
-### `awslocal sts get-caller-identity` times out
+### `lstk aws sts get-caller-identity` times out
 Confirm that port forwarding is still running in a separate terminal. If it dropped, restart it with `kubectl port-forward -n workspace svc/localstack-env-1 4566`.
 
 ### Lambda invocation returns an error after the first call
 The first invocation takes up to 30 seconds for the Lambda pod to start. Wait and retry.
 
 ### Terraform apply fails with a connection error
-Ensure port forwarding is active before running `tflocal apply`. LocalStack must be accessible on `localhost:4566`.
+Ensure port forwarding is active before running `lstk terraform apply`. LocalStack must be accessible on `localhost:4566`.
 
 ### MySQL pod does not start
 Check cluster resource availability. The MySQL pod requires sufficient CPU and memory. Run `kubectl describe pod -n workspace <ls-mysql-pod-name>` to inspect scheduling events.

@@ -180,7 +180,7 @@ In LocalStack, same-scheme listeners (for example, two HTTP listeners on ports 8
 To reach two same-scheme listeners on distinct ports, both ports must be published in [`GATEWAY_LISTEN`](/aws/customization/configuration-options/#core) when starting LocalStack:
 
 ```bash
-GATEWAY_LISTEN=0.0.0.0:4566,0.0.0.0:80,0.0.0.0:8080 localstack start
+LOCALSTACK_GATEWAY_LISTEN=0.0.0.0:4566,0.0.0.0:80,0.0.0.0:8080 lstk start
 ```
 
 ### Creating multiple listeners