Tutorials

Configuring CloudQuery with LocalStack

In this guide we will walk through how to configure CloudQuery to sync from a LocalStack instance.

Introduction to LocalStack

LocalStack is a fully functional local cloud stack that enables developers to Develop and test their cloud and serverless applications offline. It allows developers to test their cloud applications locally, without the need for an internet connection or an AWS account. This can be particularly useful for development and testing, as it allows developers to work on their applications offline and avoid incurring any charges for using AWS services.

Walkthrough

Before beginning this tutorial make sure you have the following tools installed:

Step 1: Start LocalStack

The most straightforward way of running LocalStack is to use the provided localstack docker image that is maintained by LocalStack. To run the image use the following command to spin up the container and to map the correct ports

docker run --rm -it \
-p 4566:4566 \
-p 4510-4559:4510-4559 \
-e DEBUG=1 \
localstack/localstack

Step 2: Start PostgreSQL Database

Start a local PostgreSQL Database for CloudQuery to use to store the data we will sync from LocalStack. The simplest way to do this is to start a database running locally in a docker container

#Create a database in Docker
docker run -d --name postgresdb \
-p 5432:5432 \
-e POSTGRES_PASSWORD=pass \
postgres

Step 3: Configure CloudQuery Destination

Configure a destination for CloudQuery to use to store the data. For this tutorial we will use PostgreSQL, but many other destinations are available here

# destination.yml
kind: destination
spec:
name: 'postgresql'
registry: 'cloudquery'
path: 'cloudquery/postgresql'
version: 'v8.16.0'
spec:
connection_string: 'postgresql://postgres:pass@localhost:5432/postgres?sslmode=disable'

Step 4: Configure CloudQuery Source

Configure CloudQuery's AWS source integration to use the LocalStack endpoint.

# source.yml
kind: source
spec:
# Source spec section
name: 'aws'
path: 'cloudquery/aws'
registry: 'cloudquery'
version: 'v34.9.0'
destinations: ['postgresql']
tables: ['aws_ec2_vpcs', 'aws_ec2_security_groups']
spec:
regions:
- 'us-east-1'

# Configure the AWS SDK to use the localstack endpoint
custom_endpoint_url: http://localhost:4566
custom_endpoint_hostname_immutable: true
custom_endpoint_partition_id: 'aws'
custom_endpoint_signing_region: 'us-east-1'
# There is no reason to retry failed requests to localstack
max_retries: 0

Note that it is important to skip aws_route53_delegation_sets and aws_iam_policies as bugs in LocalStack force CloudQuery into an infinite loop

Step 5: Sync Data

Run CloudQuery sync to sync the data from LocalStack to your local PostgreSQL database you started in step 2

Make sure to use fake credentials LocalStack does not support temporary IAM credentials…

AWS_ACCESS_KEY_ID=123456789100 AWS_SECRET_ACCESS_KEY=test cloudquery sync source.yml destination.yml

You can inject the desired AWS Account ID by setting it as the AWS_ACCESS_KEY_ID if you don't set a value then it will be 000000000000

Step 6: Use the Data

Query the data you just synced!

select * from aws_ec2_vpcs;

-- or

select * from aws_ec2_security_groups;

Want to see CloudQuery in action? Schedule a demo with our team or check out the platform documentation to learn more.

Want help getting started? Join the CloudQuery community to connect with other users and experts, or message our team directly here if you have any questions.

Try CloudQuery yourself

Self-hosted, open source, and free to start. Or schedule a demo to see the managed version.

Related posts

Tutorials

How to Automatically Update CloudQuery Integrations with Renovate

Configure Renovate to automatically update CloudQuery integration versions in your YAML files using the CloudQuery Hub API as a custom datasource.

Matthew M

Matthew M

May 20, 2026

AWS

Security

Tutorials

Finding AWS Unrestricted Outbound Access in 2026: EC2, Lambda, and Beyond

Find EC2, Lambda, and ECS Fargate resources with unrestricted outbound access in AWS using SQL. Why egress controls still break attack chains in 2026.

Joe Karlsson

Joe Karlsson

May 5, 2026

AWS

Security

Tutorials

AWS IAM Identity Center with Google Workspace as an IdP: 2026 Step-by-Step Guide

Set up AWS IAM Identity Center with Google Workspace: SAML authentication, SCIM user provisioning, and group sync with CLI or ssosync. Updated for 2026.

Joe Karlsson

Joe Karlsson

May 5, 2026

GCP

Security

Tutorials

Creating Cross-Project Service Accounts in GCP (Console + gcloud CLI)

Create a GCP service account that reads across all your projects with one credential. Covers gcloud CLI, org-level vs.

Joe Karlsson

Joe Karlsson

May 5, 2026

AWS

Cloud Infrastructure

Security

Tutorials

Integrate AbuseIPDB Threat Intelligence with CloudQuery

Enrich your cloud asset inventory with AbuseIPDB threat intelligence to identify public cloud IPs with known abuse reports.

Joe Karlsson

Joe Karlsson

April 20, 2026

AWS

Cloud Infrastructure

Tutorials

How to Query ipinfo.io Data with CloudQuery

Learn how to enrich your cloud asset inventory with ipinfo.io IP geolocation and threat intelligence data using CloudQuery.

Joe Karlsson

Joe Karlsson

April 20, 2026

AWS

Security

Tutorials

AWS IAM Identity Center (Formerly AWS SSO): The Complete 2026 Guide

AWS IAM Identity Center replaced AWS SSO in 2022. Learn how to set it up, configure permission sets, use the AWS CLI, and audit access with CloudQuery.

Joe Karlsson

Joe Karlsson

April 6, 2026

AWS

Tutorials

AWS Pinpoint Is Being Deprecated: How to Assess Your Migration Scope

AWS Pinpoint reaches end of support October 2026. Query your Pinpoint usage across all accounts to find what needs migrating before the deadline.

Joe Karlsson

Joe Karlsson

March 24, 2026

Tutorials

Moving Data from PostgreSQL to MotherDuck

How to sync PostgreSQL data to MotherDuck using CloudQuery, with both one-off batch and continuous CDC streaming options for serverless analytics.

Herman Schaaf

Herman Schaaf

March 13, 2026

Own your pipeline.
Own your data.