diff --git a/src/MicroStack/Services/Ec2/Ec2ServiceHandler.cs b/src/MicroStack/Services/Ec2/Ec2ServiceHandler.cs
index 34925ec..db2c297 100644
--- a/src/MicroStack/Services/Ec2/Ec2ServiceHandler.cs
+++ b/src/MicroStack/Services/Ec2/Ec2ServiceHandler.cs
@@ -185,8 +185,8 @@ private ServiceResponse DispatchAction(string action, Dictionary<string, string[
             "DescribeInstanceAttribute" => DescribeInstanceAttribute(p),
             "DescribeInstanceTypes" => DescribeInstanceTypes(p),
             "DescribeInstanceCreditSpecifications" => DescribeInstanceCreditSpecifications(p),
-            "DescribeSpotInstanceRequests" => Xml(200, "DescribeSpotInstanceRequestsResponse", "<spotInstanceRequestSet/>"),
-            "DescribeCapacityReservations" => Xml(200, "DescribeCapacityReservationsResponse", "<capacityReservationSet/>"),
+            "DescribeSpotInstanceRequests" => Xml(200, "DescribeSpotInstanceRequestsResponse", "<spotInstanceRequestSet></spotInstanceRequestSet>"),
+            "DescribeCapacityReservations" => Xml(200, "DescribeCapacityReservationsResponse", "<capacityReservationSet></capacityReservationSet>"),
             "DescribeImages" => DescribeImages(p),
             "CreateSecurityGroup" => CreateSecurityGroup(p),
             "DeleteSecurityGroup" => DeleteSecurityGroup(p),
@@ -305,9 +305,9 @@ private ServiceResponse DispatchAction(string action, Dictionary<string, string[
             "DescribeLaunchTemplateVersions" => DescribeLaunchTemplateVersions(p),
             "ModifyLaunchTemplate" => ModifyLaunchTemplate(p),
             "DeleteLaunchTemplate" => DeleteLaunchTemplate(p),
-            "DescribeAccountAttributes" => Xml(200, "DescribeAccountAttributesResponse", "<accountAttributeSet/>"),
-            "DescribeInstanceMaintenanceOptions" => Xml(200, "DescribeInstanceMaintenanceOptionsResponse", "<instanceMaintenanceOptionSet/>"),
-            "DescribeInstanceTopology" => Xml(200, "DescribeInstanceTopologyResponse", "<instanceSet/>"),
+            "DescribeAccountAttributes" => Xml(200, "DescribeAccountAttributesResponse", "<accountAttributeSet></accountAttributeSet>"),
+            "DescribeInstanceMaintenanceOptions" => Xml(200, "DescribeInstanceMaintenanceOptionsResponse", "<instanceMaintenanceOptionSet></instanceMaintenanceOptionSet>"),
+            "DescribeInstanceTopology" => Xml(200, "DescribeInstanceTopologyResponse", "<instanceSet></instanceSet>"),
             _ => Error("InvalidAction", $"Unknown EC2 action: {action}", 400),
         };
     }
@@ -371,7 +371,7 @@ private ServiceResponse RunInstances(Dictionary<string, string[]> p)
         }
 
         var reservationId = "r-" + Guid.NewGuid().ToString("N")[..17];
-        var inner = $"<instancesSet>{sb}</instancesSet><reservationId>{reservationId}</reservationId><ownerId>{AccountContext.GetAccountId()}</ownerId><groupSet/>";
+        var inner = $"<instancesSet>{sb}</instancesSet><reservationId>{reservationId}</reservationId><ownerId>{AccountContext.GetAccountId()}</ownerId><groupSet></groupSet>";
         return Xml(200, "RunInstancesResponse", inner);
     }
 
@@ -387,7 +387,7 @@ private ServiceResponse DescribeInstances(Dictionary<string, string[]> p)
             if (!MatchesInstanceFilters(inst, filters)) continue;
 
             var iid = (string)inst["InstanceId"];
-            sb.Append($"<item><reservationId>r-{iid[2..]}</reservationId><ownerId>{AccountContext.GetAccountId()}</ownerId><groupSet/><instancesSet>{InstanceXml(inst)}</instancesSet></item>");
+            sb.Append($"<item><reservationId>r-{iid[2..]}</reservationId><ownerId>{AccountContext.GetAccountId()}</ownerId><groupSet></groupSet><instancesSet>{InstanceXml(inst)}</instancesSet></item>");
         }
 
         return Xml(200, "DescribeInstancesResponse", $"<reservationSet>{sb}</reservationSet>");
@@ -465,11 +465,11 @@ private ServiceResponse DescribeInstanceAttribute(Dictionary<string, string[]> p
             "instanceType" => $"<instanceType><value>{inst.GetValueOrDefault("InstanceType", "t2.micro")}</value></instanceType>",
             "instanceInitiatedShutdownBehavior" => "<instanceInitiatedShutdownBehavior><value>stop</value></instanceInitiatedShutdownBehavior>",
             "disableApiTermination" => "<disableApiTermination><value>false</value></disableApiTermination>",
-            "userData" => "<userData/>",
+            "userData" => "<userData></userData>",
             "rootDeviceName" => "<rootDeviceName><value>/dev/xvda</value></rootDeviceName>",
             "sourceDestCheck" => "<sourceDestCheck><value>true</value></sourceDestCheck>",
             "ebsOptimized" => "<ebsOptimized><value>false</value></ebsOptimized>",
-            _ => $"<{attribute}/>",
+            _ => $"<{attribute}></{attribute}>",
         };
 
         return Xml(200, "DescribeInstanceAttributeResponse", $"<instanceId>{instanceId}</instanceId>{valueXml}");
@@ -1345,7 +1345,7 @@ private ServiceResponse DeleteVpcEndpoints(Dictionary<string, string[]> p)
     {
         var ids = ParseMemberList(p, "VpcEndpointId");
         foreach (var id in ids) _vpcEndpoints.TryRemove(id, out _);
-        return Xml(200, "DeleteVpcEndpointsResponse", "<unsuccessful/>");
+        return Xml(200, "DeleteVpcEndpointsResponse", "<unsuccessful></unsuccessful>");
     }
 
     private ServiceResponse DescribeVpcEndpoints(Dictionary<string, string[]> p)
@@ -1468,7 +1468,7 @@ private ServiceResponse DescribeVolumeStatus(Dictionary<string, string[]> p)
         foreach (var vol in _volumes.Values.ToList())
         {
             if (filterIds.Count > 0 && !filterIds.Contains((string)vol["VolumeId"])) continue;
-            sb.Append($"<item><volumeId>{vol["VolumeId"]}</volumeId><availabilityZone>{vol["AvailabilityZone"]}</availabilityZone><volumeStatus><status>ok</status><details><item><name>io-enabled</name><status>passed</status></item></details></volumeStatus><actionsSet/><eventsSet/></item>");
+            sb.Append($"<item><volumeId>{vol["VolumeId"]}</volumeId><availabilityZone>{vol["AvailabilityZone"]}</availabilityZone><volumeStatus><status>ok</status><details><item><name>io-enabled</name><status>passed</status></item></details></volumeStatus><actionsSet></actionsSet><eventsSet></eventsSet></item>");
         }
         return Xml(200, "DescribeVolumeStatusResponse", $"<volumeStatusSet>{sb}</volumeStatusSet>");
     }
@@ -1656,7 +1656,7 @@ private ServiceResponse CreateNatGateway(Dictionary<string, string[]> p)
             ["State"] = "available", ["CreateTime"] = now, ["Tags"] = tags,
         };
         if (tags.Count > 0) _tags[natId] = tags;
-        return Xml(200, "CreateNatGatewayResponse", $"<natGateway><natGatewayId>{natId}</natGatewayId><subnetId>{subnetId}</subnetId><vpcId>{vpcId}</vpcId><state>available</state><connectivityType>{connectivity}</connectivityType><createTime>{now}</createTime><natGatewayAddressSet/><tagSet/></natGateway>");
+        return Xml(200, "CreateNatGatewayResponse", $"<natGateway><natGatewayId>{natId}</natGatewayId><subnetId>{subnetId}</subnetId><vpcId>{vpcId}</vpcId><state>available</state><connectivityType>{connectivity}</connectivityType><createTime>{now}</createTime><natGatewayAddressSet></natGatewayAddressSet><tagSet></tagSet></natGateway>");
     }
 
     private ServiceResponse DescribeNatGateways(Dictionary<string, string[]> p)
@@ -1670,7 +1670,7 @@ private ServiceResponse DescribeNatGateways(Dictionary<string, string[]> p)
             if (filters.TryGetValue("state", out var stateF) && !stateF.Contains((string)nat["State"])) continue;
             if (filters.TryGetValue("vpc-id", out var vpcF) && !vpcF.Contains((string)nat["VpcId"])) continue;
             if (filters.TryGetValue("subnet-id", out var subF) && !subF.Contains((string)nat["SubnetId"])) continue;
-            sb.Append($"<item><natGatewayId>{nat["NatGatewayId"]}</natGatewayId><subnetId>{nat["SubnetId"]}</subnetId><vpcId>{nat["VpcId"]}</vpcId><state>{nat["State"]}</state><connectivityType>{nat["ConnectivityType"]}</connectivityType><createTime>{nat["CreateTime"]}</createTime><natGatewayAddressSet/><tagSet/></item>");
+            sb.Append($"<item><natGatewayId>{nat["NatGatewayId"]}</natGatewayId><subnetId>{nat["SubnetId"]}</subnetId><vpcId>{nat["VpcId"]}</vpcId><state>{nat["State"]}</state><connectivityType>{nat["ConnectivityType"]}</connectivityType><createTime>{nat["CreateTime"]}</createTime><natGatewayAddressSet></natGatewayAddressSet><tagSet></tagSet></item>");
         }
         return Xml(200, "DescribeNatGatewaysResponse", $"<natGatewaySet>{sb}</natGatewaySet>");
     }
@@ -1702,7 +1702,7 @@ private ServiceResponse CreateNetworkAcl(Dictionary<string, string[]> p)
             ["Tags"] = tags, ["OwnerId"] = accountId,
         };
         if (tags.Count > 0) _tags[aclId] = tags;
-        return Xml(200, "CreateNetworkAclResponse", $"<networkAcl><networkAclId>{aclId}</networkAclId><vpcId>{vpcId}</vpcId><default>false</default><entrySet/><associationSet/><tagSet/><ownerId>{accountId}</ownerId></networkAcl>");
+        return Xml(200, "CreateNetworkAclResponse", $"<networkAcl><networkAclId>{aclId}</networkAclId><vpcId>{vpcId}</vpcId><default>false</default><entrySet></entrySet><associationSet></associationSet><tagSet></tagSet><ownerId>{accountId}</ownerId></networkAcl>");
     }
 
     private ServiceResponse DescribeNetworkAcls(Dictionary<string, string[]> p)
@@ -1728,7 +1728,7 @@ private ServiceResponse DescribeNetworkAcls(Dictionary<string, string[]> p)
             foreach (var a in assocs)
                 assocsSb.Append($"<item><networkAclAssociationId>{a["NetworkAclAssociationId"]}</networkAclAssociationId><networkAclId>{acl["NetworkAclId"]}</networkAclId><subnetId>{a["SubnetId"]}</subnetId></item>");
             var isDefault = (bool)acl["IsDefault"] ? "true" : "false";
-            sb.Append($"<item><networkAclId>{acl["NetworkAclId"]}</networkAclId><vpcId>{acl["VpcId"]}</vpcId><default>{isDefault}</default><entrySet>{entriesSb}</entrySet><associationSet>{assocsSb}</associationSet><tagSet/><ownerId>{acl["OwnerId"]}</ownerId></item>");
+            sb.Append($"<item><networkAclId>{acl["NetworkAclId"]}</networkAclId><vpcId>{acl["VpcId"]}</vpcId><default>{isDefault}</default><entrySet>{entriesSb}</entrySet><associationSet>{assocsSb}</associationSet><tagSet></tagSet><ownerId>{acl["OwnerId"]}</ownerId></item>");
         }
         return Xml(200, "DescribeNetworkAclsResponse", $"<networkAclSet>{sb}</networkAclSet>");
     }
@@ -1833,7 +1833,7 @@ private ServiceResponse CreateFlowLogs(Dictionary<string, string[]> p)
         }
         var idsSb = new StringBuilder();
         foreach (var fid in created) idsSb.Append($"<item>{fid}</item>");
-        return Xml(200, "CreateFlowLogsResponse", $"<flowLogIdSet>{idsSb}</flowLogIdSet><unsuccessful/>");
+        return Xml(200, "CreateFlowLogsResponse", $"<flowLogIdSet>{idsSb}</flowLogIdSet><unsuccessful></unsuccessful>");
     }
 
     private ServiceResponse DescribeFlowLogs(Dictionary<string, string[]> p)
@@ -1854,7 +1854,7 @@ private ServiceResponse DeleteFlowLogs(Dictionary<string, string[]> p)
     {
         var ids = ParseMemberList(p, "FlowLogId");
         foreach (var fid in ids) _flowLogs.TryRemove(fid, out _);
-        return Xml(200, "DeleteFlowLogsResponse", "<unsuccessful/>");
+        return Xml(200, "DeleteFlowLogsResponse", "<unsuccessful></unsuccessful>");
     }
 
     // ── VPC Peering ───────────────────────────────────────────────────────────
@@ -1879,7 +1879,7 @@ private ServiceResponse CreateVpcPeeringConnection(Dictionary<string, string[]>
             ["Status"] = new Dictionary<string, object> { ["Code"] = "pending-acceptance", ["Message"] = "Pending Acceptance by " + peerOwnerId },
             ["ExpirationTime"] = NowTs(), ["Tags"] = new List<Dictionary<string, string>>(),
         };
-        return Xml(200, "CreateVpcPeeringConnectionResponse", $"<vpcPeeringConnection><vpcPeeringConnectionId>{pcxId}</vpcPeeringConnectionId><requesterVpcInfo><vpcId>{vpcId}</vpcId><ownerId>{accountId}</ownerId><region>{Region}</region></requesterVpcInfo><accepterVpcInfo><vpcId>{peerVpcId}</vpcId><ownerId>{peerOwnerId}</ownerId><region>{peerRegion}</region></accepterVpcInfo><status><code>pending-acceptance</code></status><tagSet/></vpcPeeringConnection>");
+        return Xml(200, "CreateVpcPeeringConnectionResponse", $"<vpcPeeringConnection><vpcPeeringConnectionId>{pcxId}</vpcPeeringConnectionId><requesterVpcInfo><vpcId>{vpcId}</vpcId><ownerId>{accountId}</ownerId><region>{Region}</region></requesterVpcInfo><accepterVpcInfo><vpcId>{peerVpcId}</vpcId><ownerId>{peerOwnerId}</ownerId><region>{peerRegion}</region></accepterVpcInfo><status><code>pending-acceptance</code></status><tagSet></tagSet></vpcPeeringConnection>");
     }
 
     private ServiceResponse AcceptVpcPeeringConnection(Dictionary<string, string[]> p)
@@ -1890,7 +1890,7 @@ private ServiceResponse AcceptVpcPeeringConnection(Dictionary<string, string[]>
         pcx["Status"] = new Dictionary<string, object> { ["Code"] = "active", ["Message"] = "Active" };
         var req = (Dictionary<string, object>)pcx["RequesterVpcInfo"];
         var acc = (Dictionary<string, object>)pcx["AccepterVpcInfo"];
-        return Xml(200, "AcceptVpcPeeringConnectionResponse", $"<vpcPeeringConnection><vpcPeeringConnectionId>{pcxId}</vpcPeeringConnectionId><requesterVpcInfo><vpcId>{req["VpcId"]}</vpcId><ownerId>{req["OwnerId"]}</ownerId><region>{req["Region"]}</region></requesterVpcInfo><accepterVpcInfo><vpcId>{acc["VpcId"]}</vpcId><ownerId>{acc["OwnerId"]}</ownerId><region>{acc["Region"]}</region></accepterVpcInfo><status><code>active</code></status><tagSet/></vpcPeeringConnection>");
+        return Xml(200, "AcceptVpcPeeringConnectionResponse", $"<vpcPeeringConnection><vpcPeeringConnectionId>{pcxId}</vpcPeeringConnectionId><requesterVpcInfo><vpcId>{req["VpcId"]}</vpcId><ownerId>{req["OwnerId"]}</ownerId><region>{req["Region"]}</region></requesterVpcInfo><accepterVpcInfo><vpcId>{acc["VpcId"]}</vpcId><ownerId>{acc["OwnerId"]}</ownerId><region>{acc["Region"]}</region></accepterVpcInfo><status><code>active</code></status><tagSet></tagSet></vpcPeeringConnection>");
     }
 
     private ServiceResponse DescribeVpcPeeringConnections(Dictionary<string, string[]> p)
@@ -1905,7 +1905,7 @@ private ServiceResponse DescribeVpcPeeringConnections(Dictionary<string, string[
             if (filters.TryGetValue("status-code", out var scF) && !scF.Contains((string)status["Code"])) continue;
             var req = (Dictionary<string, object>)pcx["RequesterVpcInfo"];
             var acc = (Dictionary<string, object>)pcx["AccepterVpcInfo"];
-            sb.Append($"<item><vpcPeeringConnectionId>{pcx["VpcPeeringConnectionId"]}</vpcPeeringConnectionId><requesterVpcInfo><vpcId>{req["VpcId"]}</vpcId><ownerId>{req["OwnerId"]}</ownerId><region>{req["Region"]}</region></requesterVpcInfo><accepterVpcInfo><vpcId>{acc["VpcId"]}</vpcId><ownerId>{acc["OwnerId"]}</ownerId><region>{acc["Region"]}</region></accepterVpcInfo><status><code>{status["Code"]}</code><message>{status["Message"]}</message></status><tagSet/></item>");
+            sb.Append($"<item><vpcPeeringConnectionId>{pcx["VpcPeeringConnectionId"]}</vpcPeeringConnectionId><requesterVpcInfo><vpcId>{req["VpcId"]}</vpcId><ownerId>{req["OwnerId"]}</ownerId><region>{req["Region"]}</region></requesterVpcInfo><accepterVpcInfo><vpcId>{acc["VpcId"]}</vpcId><ownerId>{acc["OwnerId"]}</ownerId><region>{acc["Region"]}</region></accepterVpcInfo><status><code>{status["Code"]}</code><message>{status["Message"]}</message></status><tagSet></tagSet></item>");
         }
         return Xml(200, "DescribeVpcPeeringConnectionsResponse", $"<vpcPeeringConnectionSet>{sb}</vpcPeeringConnectionSet>");
     }
@@ -1954,7 +1954,7 @@ private ServiceResponse CreateDhcpOptions(Dictionary<string, string[]> p)
                 valsSb.Append($"<item><value>{v}</value></item>");
             configsXml.Append($"<item><key>{c["Key"]}</key><valueSet>{valsSb}</valueSet></item>");
         }
-        return Xml(200, "CreateDhcpOptionsResponse", $"<dhcpOptions><dhcpOptionsId>{doptId}</dhcpOptionsId><dhcpConfigurationSet>{configsXml}</dhcpConfigurationSet><ownerId>{accountId}</ownerId><tagSet/></dhcpOptions>");
+        return Xml(200, "CreateDhcpOptionsResponse", $"<dhcpOptions><dhcpOptionsId>{doptId}</dhcpOptionsId><dhcpConfigurationSet>{configsXml}</dhcpConfigurationSet><ownerId>{accountId}</ownerId><tagSet></tagSet></dhcpOptions>");
     }
 
     private ServiceResponse AssociateDhcpOptions(Dictionary<string, string[]> p)
@@ -1985,7 +1985,7 @@ private ServiceResponse DescribeDhcpOptions(Dictionary<string, string[]> p)
                     valsSb.Append($"<item><value>{v}</value></item>");
                 configsXml.Append($"<item><key>{c["Key"]}</key><valueSet>{valsSb}</valueSet></item>");
             }
-            sb.Append($"<item><dhcpOptionsId>{dopt["DhcpOptionsId"]}</dhcpOptionsId><dhcpConfigurationSet>{configsXml}</dhcpConfigurationSet><ownerId>{dopt["OwnerId"]}</ownerId><tagSet/></item>");
+            sb.Append($"<item><dhcpOptionsId>{dopt["DhcpOptionsId"]}</dhcpOptionsId><dhcpConfigurationSet>{configsXml}</dhcpConfigurationSet><ownerId>{dopt["OwnerId"]}</ownerId><tagSet></tagSet></item>");
         }
         return Xml(200, "DescribeDhcpOptionsResponse", $"<dhcpOptionsSet>{sb}</dhcpOptionsSet>");
     }
@@ -2014,7 +2014,7 @@ private ServiceResponse CreateEgressOnlyInternetGateway(Dictionary<string, strin
             ["State"] = "attached", ["Tags"] = tags,
         };
         if (tags.Count > 0) _tags[eigwId] = tags;
-        return Xml(200, "CreateEgressOnlyInternetGatewayResponse", $"<egressOnlyInternetGateway><egressOnlyInternetGatewayId>{eigwId}</egressOnlyInternetGatewayId><attachmentSet><item><vpcId>{vpcId}</vpcId><state>attached</state></item></attachmentSet><tagSet/></egressOnlyInternetGateway>");
+        return Xml(200, "CreateEgressOnlyInternetGatewayResponse", $"<egressOnlyInternetGateway><egressOnlyInternetGatewayId>{eigwId}</egressOnlyInternetGatewayId><attachmentSet><item><vpcId>{vpcId}</vpcId><state>attached</state></item></attachmentSet><tagSet></tagSet></egressOnlyInternetGateway>");
     }
 
     private ServiceResponse DescribeEgressOnlyInternetGateways(Dictionary<string, string[]> p)
@@ -2024,7 +2024,7 @@ private ServiceResponse DescribeEgressOnlyInternetGateways(Dictionary<string, st
         foreach (var eigw in _egressIgws.Values.ToList())
         {
             if (ids.Count > 0 && !ids.Contains((string)eigw["EgressOnlyInternetGatewayId"])) continue;
-            sb.Append($"<item><egressOnlyInternetGatewayId>{eigw["EgressOnlyInternetGatewayId"]}</egressOnlyInternetGatewayId><attachmentSet><item><vpcId>{eigw["VpcId"]}</vpcId><state>{eigw["State"]}</state></item></attachmentSet><tagSet/></item>");
+            sb.Append($"<item><egressOnlyInternetGatewayId>{eigw["EgressOnlyInternetGatewayId"]}</egressOnlyInternetGatewayId><attachmentSet><item><vpcId>{eigw["VpcId"]}</vpcId><state>{eigw["State"]}</state></item></attachmentSet><tagSet></tagSet></item>");
         }
         return Xml(200, "DescribeEgressOnlyInternetGatewaysResponse", $"<egressOnlyInternetGatewaySet>{sb}</egressOnlyInternetGatewaySet>");
     }
@@ -2506,7 +2506,7 @@ private static string SgXml(Dictionary<string, object> sg)
         var egress = new StringBuilder();
         foreach (var r in (List<Dictionary<string, object>>)sg["IpPermissionsEgress"])
             egress.Append(PermXml(r));
-        return $"<item><ownerId>{sg["OwnerId"]}</ownerId><groupId>{sg["GroupId"]}</groupId><groupName>{sg["GroupName"]}</groupName><groupDescription>{sg["Description"]}</groupDescription><vpcId>{sg["VpcId"]}</vpcId><ipPermissions>{ingress}</ipPermissions><ipPermissionsEgress>{egress}</ipPermissionsEgress><tagSet/></item>";
+        return $"<item><ownerId>{sg["OwnerId"]}</ownerId><groupId>{sg["GroupId"]}</groupId><groupName>{sg["GroupName"]}</groupName><groupDescription>{sg["Description"]}</groupDescription><vpcId>{sg["VpcId"]}</vpcId><ipPermissions>{ingress}</ipPermissions><ipPermissionsEgress>{egress}</ipPermissionsEgress><tagSet></tagSet></item>";
     }
 
     private static string PermXml(Dictionary<string, object> r)
@@ -2516,7 +2516,7 @@ private static string PermXml(Dictionary<string, object> r)
             ranges.Append($"<item><cidrIp>{ip["CidrIp"]}</cidrIp></item>");
         var fromPort = r.ContainsKey("FromPort") ? $"<fromPort>{r["FromPort"]}</fromPort>" : "";
         var toPort = r.ContainsKey("ToPort") ? $"<toPort>{r["ToPort"]}</toPort>" : "";
-        return $"<item><ipProtocol>{r.GetValueOrDefault("IpProtocol", "-1")}</ipProtocol>{fromPort}{toPort}<ipRanges>{ranges}</ipRanges><ipv6Ranges/><prefixListIds/><groups/></item>";
+        return $"<item><ipProtocol>{r.GetValueOrDefault("IpProtocol", "-1")}</ipProtocol>{fromPort}{toPort}<ipRanges>{ranges}</ipRanges><ipv6Ranges></ipv6Ranges><prefixListIds></prefixListIds><groups></groups></item>";
     }
 
     private static string VpcXml(Dictionary<string, object> vpc)
@@ -2534,7 +2534,7 @@ private static string VpcXml(Dictionary<string, object> vpc, string tag)
             extra.Append($"<defaultSecurityGroupId>{dsg}</defaultSecurityGroupId>");
         if (vpc.TryGetValue("MainRouteTableId", out var mrt) && !string.IsNullOrEmpty((string)mrt))
             extra.Append($"<mainRouteTableId>{mrt}</mainRouteTableId>");
-        return $"<{tag}><vpcId>{vpc["VpcId"]}</vpcId><state>{vpc["State"]}</state><cidrBlock>{vpc["CidrBlock"]}</cidrBlock><dhcpOptionsId>{vpc["DhcpOptionsId"]}</dhcpOptionsId><instanceTenancy>{vpc["InstanceTenancy"]}</instanceTenancy><isDefault>{isDefault}</isDefault><ownerId>{vpc["OwnerId"]}</ownerId>{extra}<tagSet/></{tag}>";
+        return $"<{tag}><vpcId>{vpc["VpcId"]}</vpcId><state>{vpc["State"]}</state><cidrBlock>{vpc["CidrBlock"]}</cidrBlock><dhcpOptionsId>{vpc["DhcpOptionsId"]}</dhcpOptionsId><instanceTenancy>{vpc["InstanceTenancy"]}</instanceTenancy><isDefault>{isDefault}</isDefault><ownerId>{vpc["OwnerId"]}</ownerId>{extra}<tagSet></tagSet></{tag}>";
     }
 
     private static string SubnetXml(Dictionary<string, object> subnet)
@@ -2548,7 +2548,7 @@ private static string SubnetXml(Dictionary<string, object> subnet, string tag)
         var accountId = AccountContext.GetAccountId();
         var defaultForAz = (bool)subnet["DefaultForAz"] ? "true" : "false";
         var mapPublic = (bool)subnet["MapPublicIpOnLaunch"] ? "true" : "false";
-        return $"<{tag}><subnetId>{subnet["SubnetId"]}</subnetId><subnetArn>arn:aws:ec2:{region}:{accountId}:subnet/{subnet["SubnetId"]}</subnetArn><state>{subnet["State"]}</state><vpcId>{subnet["VpcId"]}</vpcId><cidrBlock>{subnet["CidrBlock"]}</cidrBlock><availableIpAddressCount>{subnet["AvailableIpAddressCount"]}</availableIpAddressCount><availabilityZone>{subnet["AvailabilityZone"]}</availabilityZone><defaultForAz>{defaultForAz}</defaultForAz><mapPublicIpOnLaunch>{mapPublic}</mapPublicIpOnLaunch><ownerId>{subnet["OwnerId"]}</ownerId><tagSet/></{tag}>";
+        return $"<{tag}><subnetId>{subnet["SubnetId"]}</subnetId><subnetArn>arn:aws:ec2:{region}:{accountId}:subnet/{subnet["SubnetId"]}</subnetArn><state>{subnet["State"]}</state><vpcId>{subnet["VpcId"]}</vpcId><cidrBlock>{subnet["CidrBlock"]}</cidrBlock><availableIpAddressCount>{subnet["AvailableIpAddressCount"]}</availableIpAddressCount><availabilityZone>{subnet["AvailabilityZone"]}</availabilityZone><defaultForAz>{defaultForAz}</defaultForAz><mapPublicIpOnLaunch>{mapPublic}</mapPublicIpOnLaunch><ownerId>{subnet["OwnerId"]}</ownerId><tagSet></tagSet></{tag}>";
     }
 
     private static string IgwXml(Dictionary<string, object> igw)
@@ -2561,7 +2561,7 @@ private static string IgwXml(Dictionary<string, object> igw, string tag)
         var attachments = new StringBuilder();
         foreach (var a in (List<Dictionary<string, string>>)igw["Attachments"])
             attachments.Append($"<item><vpcId>{a["VpcId"]}</vpcId><state>{a["State"]}</state></item>");
-        return $"<{tag}><internetGatewayId>{igw["InternetGatewayId"]}</internetGatewayId><ownerId>{igw["OwnerId"]}</ownerId><attachmentSet>{attachments}</attachmentSet><tagSet/></{tag}>";
+        return $"<{tag}><internetGatewayId>{igw["InternetGatewayId"]}</internetGatewayId><ownerId>{igw["OwnerId"]}</ownerId><attachmentSet>{attachments}</attachmentSet><tagSet></tagSet></{tag}>";
     }
 
     private static string RtbXml(Dictionary<string, object> rtb)
@@ -2596,7 +2596,7 @@ private static string RtbXml(Dictionary<string, object> rtb, string tag)
             var isMain = a.ContainsKey("Main") && (bool)a["Main"] ? "true" : "false";
             assocsSb.Append($"<item><routeTableAssociationId>{a["RouteTableAssociationId"]}</routeTableAssociationId><routeTableId>{a["RouteTableId"]}</routeTableId><main>{isMain}</main>{subnetPart}<associationState><state>associated</state></associationState></item>");
         }
-        return $"<{tag}><routeTableId>{rtb["RouteTableId"]}</routeTableId><vpcId>{rtb["VpcId"]}</vpcId><ownerId>{rtb["OwnerId"]}</ownerId><routeSet>{routesSb}</routeSet><associationSet>{assocsSb}</associationSet><propagatingVgwSet/><tagSet/></{tag}>";
+        return $"<{tag}><routeTableId>{rtb["RouteTableId"]}</routeTableId><vpcId>{rtb["VpcId"]}</vpcId><ownerId>{rtb["OwnerId"]}</ownerId><routeSet>{routesSb}</routeSet><associationSet>{assocsSb}</associationSet><propagatingVgwSet></propagatingVgwSet><tagSet></tagSet></{tag}>";
     }
 
     private static string EniXml(Dictionary<string, object> eni)
@@ -2618,7 +2618,7 @@ private static string EniXml(Dictionary<string, object> eni, string tag)
         var privateIp = (string)eni["PrivateIpAddress"];
         var region = MicroStackOptions.Instance.Region;
         var sourceDestCheck = eni.TryGetValue("SourceDestCheck", out var sdc) && sdc is bool sdcBool ? (sdcBool ? "true" : "false") : "true";
-        return $"<{tag}><networkInterfaceId>{eni["NetworkInterfaceId"]}</networkInterfaceId><subnetId>{eni["SubnetId"]}</subnetId><vpcId>{eni["VpcId"]}</vpcId><availabilityZone>{eni.GetValueOrDefault("AvailabilityZone", region + "a")}</availabilityZone><description>{eni["Description"]}</description><ownerId>{eni["OwnerId"]}</ownerId><status>{eni["Status"]}</status><privateIpAddress>{privateIp}</privateIpAddress><sourceDestCheck>{sourceDestCheck}</sourceDestCheck><interfaceType>{eni.GetValueOrDefault("InterfaceType", "interface")}</interfaceType><macAddress>{eni["MacAddress"]}</macAddress><groupSet>{groups}</groupSet><privateIpAddressesSet><item><privateIpAddress>{privateIp}</privateIpAddress><primary>true</primary></item></privateIpAddressesSet>{attachment}<tagSet/></{tag}>";
+        return $"<{tag}><networkInterfaceId>{eni["NetworkInterfaceId"]}</networkInterfaceId><subnetId>{eni["SubnetId"]}</subnetId><vpcId>{eni["VpcId"]}</vpcId><availabilityZone>{eni.GetValueOrDefault("AvailabilityZone", region + "a")}</availabilityZone><description>{eni["Description"]}</description><ownerId>{eni["OwnerId"]}</ownerId><status>{eni["Status"]}</status><privateIpAddress>{privateIp}</privateIpAddress><sourceDestCheck>{sourceDestCheck}</sourceDestCheck><interfaceType>{eni.GetValueOrDefault("InterfaceType", "interface")}</interfaceType><macAddress>{eni["MacAddress"]}</macAddress><groupSet>{groups}</groupSet><privateIpAddressesSet><item><privateIpAddress>{privateIp}</privateIpAddress><primary>true</primary></item></privateIpAddressesSet>{attachment}<tagSet></tagSet></{tag}>";
     }
 
     private static string VpceXml(Dictionary<string, object> ep)
@@ -2634,7 +2634,7 @@ private static string VpceXml(Dictionary<string, object> ep, string tag)
         var subnetIds = new StringBuilder();
         foreach (var s in (List<string>)ep.GetValueOrDefault("SubnetIds", new List<string>())!)
             subnetIds.Append($"<item>{s}</item>");
-        return $"<{tag}><vpcEndpointId>{ep["VpcEndpointId"]}</vpcEndpointId><vpcEndpointType>{ep["VpcEndpointType"]}</vpcEndpointType><vpcId>{ep["VpcId"]}</vpcId><serviceName>{ep["ServiceName"]}</serviceName><state>{ep["State"]}</state><ownerId>{ep["OwnerId"]}</ownerId><routeTableIdSet>{rtbIds}</routeTableIdSet><subnetIdSet>{subnetIds}</subnetIdSet><tagSet/></{tag}>";
+        return $"<{tag}><vpcEndpointId>{ep["VpcEndpointId"]}</vpcEndpointId><vpcEndpointType>{ep["VpcEndpointType"]}</vpcEndpointType><vpcId>{ep["VpcId"]}</vpcId><serviceName>{ep["ServiceName"]}</serviceName><state>{ep["State"]}</state><ownerId>{ep["OwnerId"]}</ownerId><routeTableIdSet>{rtbIds}</routeTableIdSet><subnetIdSet>{subnetIds}</subnetIdSet><tagSet></tagSet></{tag}>";
     }
 
     private static string VolumeInnerXml(Dictionary<string, object> vol)
@@ -2645,23 +2645,23 @@ private static string VolumeInnerXml(Dictionary<string, object> vol)
             var dot = (bool)a["DeleteOnTermination"] ? "true" : "false";
             attachments.Append($"<item><volumeId>{a["VolumeId"]}</volumeId><instanceId>{a["InstanceId"]}</instanceId><device>{a["Device"]}</device><status>{a["State"]}</status><attachTime>{a["AttachTime"]}</attachTime><deleteOnTermination>{dot}</deleteOnTermination></item>");
         }
-        var snap = !string.IsNullOrEmpty((string)vol["SnapshotId"]) ? $"<snapshotId>{vol["SnapshotId"]}</snapshotId>" : "<snapshotId/>";
+        var snap = !string.IsNullOrEmpty((string)vol["SnapshotId"]) ? $"<snapshotId>{vol["SnapshotId"]}</snapshotId>" : "<snapshotId></snapshotId>";
         var iops = (int)vol["Iops"] != 0 ? $"<iops>{vol["Iops"]}</iops>" : "";
         var encrypted = (bool)vol["Encrypted"] ? "true" : "false";
         var multiAttach = (bool)vol["MultiAttachEnabled"] ? "true" : "false";
-        return $"<volumeId>{vol["VolumeId"]}</volumeId><size>{vol["Size"]}</size><availabilityZone>{vol["AvailabilityZone"]}</availabilityZone><status>{vol["State"]}</status><createTime>{vol["CreateTime"]}</createTime><volumeType>{vol["VolumeType"]}</volumeType>{snap}{iops}<encrypted>{encrypted}</encrypted><multiAttachEnabled>{multiAttach}</multiAttachEnabled><attachmentSet>{attachments}</attachmentSet><tagSet/>";
+        return $"<volumeId>{vol["VolumeId"]}</volumeId><size>{vol["Size"]}</size><availabilityZone>{vol["AvailabilityZone"]}</availabilityZone><status>{vol["State"]}</status><createTime>{vol["CreateTime"]}</createTime><volumeType>{vol["VolumeType"]}</volumeType>{snap}{iops}<encrypted>{encrypted}</encrypted><multiAttachEnabled>{multiAttach}</multiAttachEnabled><attachmentSet>{attachments}</attachmentSet><tagSet></tagSet>";
     }
 
     private static string SnapshotInnerXml(Dictionary<string, object> snap)
     {
         var encrypted = (bool)snap["Encrypted"] ? "true" : "false";
-        return $"<snapshotId>{snap["SnapshotId"]}</snapshotId><volumeId>{snap["VolumeId"]}</volumeId><status>{snap["State"]}</status><startTime>{snap["StartTime"]}</startTime><progress>{snap["Progress"]}</progress><ownerId>{snap["OwnerId"]}</ownerId><volumeSize>{snap["VolumeSize"]}</volumeSize><description>{Esc((string)snap["Description"])}</description><encrypted>{encrypted}</encrypted><storageTier>{snap["StorageTier"]}</storageTier><tagSet/>";
+        return $"<snapshotId>{snap["SnapshotId"]}</snapshotId><volumeId>{snap["VolumeId"]}</volumeId><status>{snap["State"]}</status><startTime>{snap["StartTime"]}</startTime><progress>{snap["Progress"]}</progress><ownerId>{snap["OwnerId"]}</ownerId><volumeSize>{snap["VolumeSize"]}</volumeSize><description>{Esc((string)snap["Description"])}</description><encrypted>{encrypted}</encrypted><storageTier>{snap["StorageTier"]}</storageTier><tagSet></tagSet>";
     }
 
     private static string PrefixListXml(Dictionary<string, object> pl, string tag)
     {
         var accountId = AccountContext.GetAccountId();
-        return $"<{tag}><prefixListId>{pl["PrefixListId"]}</prefixListId><prefixListName>{pl.GetValueOrDefault("PrefixListName", "")}</prefixListName><state>{pl.GetValueOrDefault("State", "create-complete")}</state><addressFamily>{pl.GetValueOrDefault("AddressFamily", "IPv4")}</addressFamily><maxEntries>{pl.GetValueOrDefault("MaxEntries", 10)}</maxEntries><version>{pl.GetValueOrDefault("Version", 1)}</version><prefixListArn>{pl.GetValueOrDefault("PrefixListArn", "")}</prefixListArn><ownerId>{pl.GetValueOrDefault("OwnerId", accountId)}</ownerId><tagSet/></{tag}>";
+        return $"<{tag}><prefixListId>{pl["PrefixListId"]}</prefixListId><prefixListName>{pl.GetValueOrDefault("PrefixListName", "")}</prefixListName><state>{pl.GetValueOrDefault("State", "create-complete")}</state><addressFamily>{pl.GetValueOrDefault("AddressFamily", "IPv4")}</addressFamily><maxEntries>{pl.GetValueOrDefault("MaxEntries", 10)}</maxEntries><version>{pl.GetValueOrDefault("Version", 1)}</version><prefixListArn>{pl.GetValueOrDefault("PrefixListArn", "")}</prefixListArn><ownerId>{pl.GetValueOrDefault("OwnerId", accountId)}</ownerId><tagSet></tagSet></{tag}>";
     }
 
     private static string VgwXml(Dictionary<string, object> vgw, string tag)
@@ -2669,12 +2669,12 @@ private static string VgwXml(Dictionary<string, object> vgw, string tag)
         var attachments = new StringBuilder();
         foreach (var a in (List<Dictionary<string, object>>)vgw["Attachments"])
             attachments.Append($"<item><vpcId>{a["VpcId"]}</vpcId><state>{a["State"]}</state></item>");
-        return $"<{tag}><vpnGatewayId>{vgw["VpnGatewayId"]}</vpnGatewayId><state>{vgw["State"]}</state><type>{vgw["Type"]}</type><availabilityZone>{vgw.GetValueOrDefault("AvailabilityZone", "")}</availabilityZone><amazonSideAsn>{vgw.GetValueOrDefault("AmazonSideAsn", "64512")}</amazonSideAsn><attachments>{attachments}</attachments><tagSet/></{tag}>";
+        return $"<{tag}><vpnGatewayId>{vgw["VpnGatewayId"]}</vpnGatewayId><state>{vgw["State"]}</state><type>{vgw["Type"]}</type><availabilityZone>{vgw.GetValueOrDefault("AvailabilityZone", "")}</availabilityZone><amazonSideAsn>{vgw.GetValueOrDefault("AmazonSideAsn", "64512")}</amazonSideAsn><attachments>{attachments}</attachments><tagSet></tagSet></{tag}>";
     }
 
     private static string CgwXml(Dictionary<string, object> cgw, string tag)
     {
-        return $"<{tag}><customerGatewayId>{cgw["CustomerGatewayId"]}</customerGatewayId><bgpAsn>{cgw["BgpAsn"]}</bgpAsn><ipAddress>{cgw["IpAddress"]}</ipAddress><type>{cgw["Type"]}</type><state>{cgw["State"]}</state><tagSet/></{tag}>";
+        return $"<{tag}><customerGatewayId>{cgw["CustomerGatewayId"]}</customerGatewayId><bgpAsn>{cgw["BgpAsn"]}</bgpAsn><ipAddress>{cgw["IpAddress"]}</ipAddress><type>{cgw["Type"]}</type><state>{cgw["State"]}</state><tagSet></tagSet></{tag}>";
     }
 
     // ── Launch Template helpers ───────────────────────────────────────────────
diff --git a/tests/MicroStack.Tests/AlbTests.cs b/tests/MicroStack.Tests/AlbTests.cs
index 430ec1d..fd90950 100644
--- a/tests/MicroStack.Tests/AlbTests.cs
+++ b/tests/MicroStack.Tests/AlbTests.cs
@@ -78,7 +78,7 @@ await _elb.DeleteLoadBalancerAsync(new DeleteLoadBalancerRequest
         });
 
         var descAfter = await _elb.DescribeLoadBalancersAsync(new DescribeLoadBalancersRequest());
-        descAfter.LoadBalancers.ShouldNotContain(l => l.LoadBalancerArn == lbArn);
+        (descAfter.LoadBalancers ?? []).ShouldNotContain(l => l.LoadBalancerArn == lbArn);
     }
 
     [Fact]
@@ -211,7 +211,7 @@ await _elb.DeleteTargetGroupAsync(new DeleteTargetGroupRequest
         });
 
         var descAfter = await _elb.DescribeTargetGroupsAsync(new DescribeTargetGroupsRequest());
-        descAfter.TargetGroups.ShouldNotContain(t => t.TargetGroupArn == tgArn);
+        (descAfter.TargetGroups ?? []).ShouldNotContain(t => t.TargetGroupArn == tgArn);
     }
 
     [Fact]
@@ -404,7 +404,7 @@ await _elb.DeleteListenerAsync(new DeleteListenerRequest
         {
             LoadBalancerArn = lbArn,
         });
-        descAfter.Listeners.ShouldNotContain(l => l.ListenerArn == lArn);
+        (descAfter.Listeners ?? []).ShouldNotContain(l => l.ListenerArn == lArn);
 
         await _elb.DeleteTargetGroupAsync(new DeleteTargetGroupRequest { TargetGroupArn = tgArn });
         await _elb.DeleteLoadBalancerAsync(new DeleteLoadBalancerRequest { LoadBalancerArn = lbArn });
@@ -1288,7 +1288,7 @@ public async Task DescribeTargetGroupsByLoadBalancerArn()
         {
             LoadBalancerArn = lbArn,
         });
-        before.TargetGroups.ShouldNotContain(tg => tg.TargetGroupArn == tgArn);
+        (before.TargetGroups ?? []).ShouldNotContain(tg => tg.TargetGroupArn == tgArn);
 
         // Create listener to link TG to LB
         var lArn = (await _elb.CreateListenerAsync(new CreateListenerRequest
diff --git a/tests/MicroStack.Tests/Ec2Tests.cs b/tests/MicroStack.Tests/Ec2Tests.cs
index 8776e00..668fac6 100644
--- a/tests/MicroStack.Tests/Ec2Tests.cs
+++ b/tests/MicroStack.Tests/Ec2Tests.cs
@@ -70,7 +70,7 @@ public async Task CreateAndDeleteVpc()
         await _ec2.DeleteVpcAsync(new DeleteVpcRequest { VpcId = vpcId });
 
         var descAfter = await _ec2.DescribeVpcsAsync(new DescribeVpcsRequest());
-        descAfter.Vpcs.ShouldNotContain(v => v.VpcId == vpcId);
+        (descAfter.Vpcs ?? []).ShouldNotContain(v => v.VpcId == vpcId);
     }
 
     [Fact]
@@ -276,7 +276,7 @@ public async Task SecurityGroupCrud()
         await _ec2.DeleteSecurityGroupAsync(new DeleteSecurityGroupRequest { GroupId = sgId });
 
         var descAfter = await _ec2.DescribeSecurityGroupsAsync(new DescribeSecurityGroupsRequest());
-        descAfter.SecurityGroups.ShouldNotContain(sg => sg.GroupId == sgId);
+        (descAfter.SecurityGroups ?? []).ShouldNotContain(sg => sg.GroupId == sgId);
     }
 
     [Fact]
@@ -347,7 +347,7 @@ await _ec2.RevokeSecurityGroupIngressAsync(new RevokeSecurityGroupIngressRequest
         {
             GroupIds = [sgId],
         });
-        descAfter.SecurityGroups[0].IpPermissions.ShouldNotContain(p => p.FromPort == 80);
+        (descAfter.SecurityGroups[0].IpPermissions ?? []).ShouldNotContain(p => p.FromPort == 80);
 
         await _ec2.DeleteSecurityGroupAsync(new DeleteSecurityGroupRequest { GroupId = sgId });
     }
@@ -373,7 +373,7 @@ public async Task KeyPairCrud()
         await _ec2.DeleteKeyPairAsync(new DeleteKeyPairRequest { KeyName = "qa-ec2-key" });
 
         var descAfter = await _ec2.DescribeKeyPairsAsync(new DescribeKeyPairsRequest());
-        descAfter.KeyPairs.ShouldNotContain(kp => kp.KeyName == "qa-ec2-key");
+        (descAfter.KeyPairs ?? []).ShouldNotContain(kp => kp.KeyName == "qa-ec2-key");
     }
 
     [Fact]
@@ -504,7 +504,7 @@ await _ec2.DisassociateRouteTableAsync(new DisassociateRouteTableRequest
         {
             RouteTableIds = [rtbId],
         });
-        descAfter.RouteTables[0].Associations.ShouldNotContain(a => a.RouteTableAssociationId == assocId);
+        (descAfter.RouteTables[0].Associations ?? []).ShouldNotContain(a => a.RouteTableAssociationId == assocId);
 
         await _ec2.DeleteRouteTableAsync(new DeleteRouteTableRequest { RouteTableId = rtbId });
         await _ec2.DeleteSubnetAsync(new DeleteSubnetRequest { SubnetId = subnetId });
@@ -551,7 +551,7 @@ await _ec2.DeleteRouteAsync(new DeleteRouteRequest
         {
             RouteTableIds = [rtbId],
         });
-        descAfter.RouteTables[0].Routes.ShouldNotContain(r => r.DestinationCidrBlock == "0.0.0.0/0");
+        (descAfter.RouteTables[0].Routes ?? []).ShouldNotContain(r => r.DestinationCidrBlock == "0.0.0.0/0");
 
         await _ec2.DeleteInternetGatewayAsync(new DeleteInternetGatewayRequest { InternetGatewayId = igwId });
         await _ec2.DeleteRouteTableAsync(new DeleteRouteTableRequest { RouteTableId = rtbId });
@@ -916,7 +916,7 @@ await _ec2.DeleteTagsAsync(new DeleteTagsRequest
             InstanceIds = [iid],
         });
         var tags2 = desc2.Reservations[0].Instances[0].Tags;
-        tags2.ShouldNotContain(t => t.Key == "Name");
+        (tags2 ?? []).ShouldNotContain(t => t.Key == "Name");
 
         await _ec2.TerminateInstancesAsync(new TerminateInstancesRequest { InstanceIds = [iid] });
     }
@@ -987,7 +987,7 @@ await _ec2.CreateTagsAsync(new CreateTagsRequest
         {
             Filters = [new Filter("resource-id", ["i-doesnotexist"])],
         });
-        resp4.Tags.ShouldBeEmpty();
+        (resp4.Tags ?? []).ShouldBeEmpty();
 
         // All tags have correct resource type
         var resp5 = await _ec2.DescribeTagsAsync(new DescribeTagsRequest
@@ -1032,7 +1032,7 @@ await _ec2.DeleteNetworkInterfaceAsync(new DeleteNetworkInterfaceRequest
         });
 
         var descAfter = await _ec2.DescribeNetworkInterfacesAsync(new DescribeNetworkInterfacesRequest());
-        descAfter.NetworkInterfaces.ShouldNotContain(e => e.NetworkInterfaceId == eniId);
+        (descAfter.NetworkInterfaces ?? []).ShouldNotContain(e => e.NetworkInterfaceId == eniId);
 
         await _ec2.DeleteSubnetAsync(new DeleteSubnetRequest { SubnetId = subnetId });
         await _ec2.DeleteVpcAsync(new DeleteVpcRequest { VpcId = vpcId });
@@ -1124,7 +1124,7 @@ await _ec2.DeleteVpcEndpointsAsync(new DeleteVpcEndpointsRequest
         });
 
         var descAfter = await _ec2.DescribeVpcEndpointsAsync(new DescribeVpcEndpointsRequest());
-        descAfter.VpcEndpoints.ShouldNotContain(e => e.VpcEndpointId == vpceId);
+        (descAfter.VpcEndpoints ?? []).ShouldNotContain(e => e.VpcEndpointId == vpceId);
 
         await _ec2.DeleteVpcAsync(new DeleteVpcRequest { VpcId = vpcId });
     }
@@ -1167,7 +1167,7 @@ await _ec2.ModifyVpcEndpointAsync(new ModifyVpcEndpointRequest
             {
                 VpcEndpointIds = [vpceId],
             });
-            desc.VpcEndpoints[0].RouteTableIds.ShouldNotContain(rtbId);
+            (desc.VpcEndpoints[0].RouteTableIds ?? []).ShouldNotContain(rtbId);
 
             await _ec2.DeleteVpcEndpointsAsync(new DeleteVpcEndpointsRequest { VpcEndpointIds = [vpceId] });
             await _ec2.DeleteRouteTableAsync(new DeleteRouteTableRequest { RouteTableId = rtbId });
@@ -1252,7 +1252,7 @@ await _ec2.AttachVolumeAsync(new AttachVolumeRequest
             VolumeIds = [volId],
         });
         desc2.Volumes[0].State.ShouldBe(VolumeState.Available);
-        desc2.Volumes[0].Attachments.ShouldBeEmpty();
+        (desc2.Volumes[0].Attachments ?? []).ShouldBeEmpty();
     }
 
     [Fact]
@@ -1272,7 +1272,7 @@ public async Task DeleteVolume()
         {
             VolumeIds = [volId],
         });
-        desc.Volumes.ShouldBeEmpty();
+        (desc.Volumes ?? []).ShouldBeEmpty();
     }
 
     [Fact]
@@ -1416,7 +1416,7 @@ await _ec2.DeleteSnapshotAsync(new DeleteSnapshotRequest
         {
             SnapshotIds = [snap.Snapshot.SnapshotId],
         });
-        desc.Snapshots.ShouldBeEmpty();
+        (desc.Snapshots ?? []).ShouldBeEmpty();
     }
 
     [Fact]
@@ -1536,14 +1536,14 @@ public async Task DescribeInstanceCreditSpecifications()
     public async Task DescribeSpotInstanceRequests()
     {
         var resp = await _ec2.DescribeSpotInstanceRequestsAsync(new DescribeSpotInstanceRequestsRequest());
-        resp.SpotInstanceRequests.ShouldBeEmpty();
+        (resp.SpotInstanceRequests ?? []).ShouldBeEmpty();
     }
 
     [Fact]
     public async Task DescribeCapacityReservations()
     {
         var resp = await _ec2.DescribeCapacityReservationsAsync(new DescribeCapacityReservationsRequest());
-        resp.CapacityReservations.ShouldBeEmpty();
+        (resp.CapacityReservations ?? []).ShouldBeEmpty();
     }
 
     // ── Describe Prefix Lists ───────────────────────────────────────────────────
@@ -1818,14 +1818,14 @@ await _ec2.DeleteNetworkAclEntryAsync(new DeleteNetworkAclEntryRequest
         {
             NetworkAclIds = [aclId],
         });
-        desc3.NetworkAcls[0].Entries.ShouldBeEmpty();
+        (desc3.NetworkAcls[0].Entries ?? []).ShouldBeEmpty();
 
         await _ec2.DeleteNetworkAclAsync(new DeleteNetworkAclRequest { NetworkAclId = aclId });
         var desc4 = await _ec2.DescribeNetworkAclsAsync(new DescribeNetworkAclsRequest
         {
             NetworkAclIds = [aclId],
         });
-        desc4.NetworkAcls.ShouldBeEmpty();
+        (desc4.NetworkAcls ?? []).ShouldBeEmpty();
     }
 
     [Fact]
@@ -1881,7 +1881,7 @@ public async Task FlowLogsCrud()
             LogDestinationType = LogDestinationType.CloudWatchLogs,
             LogGroupName = "/aws/vpc/flowlogs",
         });
-        resp.Unsuccessful.ShouldBeEmpty();
+        (resp.Unsuccessful ?? []).ShouldBeEmpty();
         var flIds = resp.FlowLogIds;
         flIds.ShouldHaveSingleItem();
         flIds[0].ShouldStartWith("fl-");
@@ -1899,7 +1899,7 @@ public async Task FlowLogsCrud()
         {
             FlowLogIds = flIds,
         });
-        desc2.FlowLogs.ShouldBeEmpty();
+        (desc2.FlowLogs ?? []).ShouldBeEmpty();
     }
 
     // ── VPC Peering Tests ───────────────────────────────────────────────────────
@@ -2003,7 +2003,7 @@ await _ec2.AssociateDhcpOptionsAsync(new AssociateDhcpOptionsRequest
         {
             DhcpOptionsIds = [doptId],
         });
-        desc2.DhcpOptions.ShouldBeEmpty();
+        (desc2.DhcpOptions ?? []).ShouldBeEmpty();
     }
 
     [Fact]
@@ -2051,7 +2051,7 @@ await _ec2.DeleteEgressOnlyInternetGatewayAsync(new DeleteEgressOnlyInternetGate
             {
                 EgressOnlyInternetGatewayIds = [eigwId],
             });
-        desc2.EgressOnlyInternetGateways.ShouldBeEmpty();
+        (desc2.EgressOnlyInternetGateways ?? []).ShouldBeEmpty();
     }
 
     [Fact]
@@ -2113,14 +2113,14 @@ await _ec2.DetachVpnGatewayAsync(new DetachVpnGatewayRequest
             {
                 VpnGatewayIds = [vgwId],
             });
-            desc2.VpnGateways[0].VpcAttachments.ShouldBeEmpty();
+            (desc2.VpnGateways[0].VpcAttachments ?? []).ShouldBeEmpty();
 
             await _ec2.DeleteVpnGatewayAsync(new DeleteVpnGatewayRequest { VpnGatewayId = vgwId });
             var desc3 = await _ec2.DescribeVpnGatewaysAsync(new DescribeVpnGatewaysRequest
             {
                 VpnGatewayIds = [vgwId],
             });
-            desc3.VpnGateways.ShouldBeEmpty();
+            (desc3.VpnGateways ?? []).ShouldBeEmpty();
         }
         finally
         {
@@ -2195,7 +2195,7 @@ await _ec2.DeleteCustomerGatewayAsync(new DeleteCustomerGatewayRequest
         {
             CustomerGatewayIds = [cgwId],
         });
-        desc2.CustomerGateways.ShouldBeEmpty();
+        (desc2.CustomerGateways ?? []).ShouldBeEmpty();
     }
 
     // ── Create Route with NAT Gateway ───────────────────────────────────────────
@@ -2322,8 +2322,8 @@ await _ec2.ModifyManagedPrefixListAsync(new ModifyManagedPrefixListRequest
             PrefixListId = plId,
         });
         cidrs = entries.Entries.Select(e => e.Cidr).ToList();
-        cidrs.ShouldNotContain("10.0.0.0/8");
-        cidrs.ShouldContain("172.16.0.0/12");
+        (cidrs ?? []).ShouldNotContain("10.0.0.0/8");
+        (cidrs ?? []).ShouldContain("172.16.0.0/12");
 
         // Delete
         await _ec2.DeleteManagedPrefixListAsync(new DeleteManagedPrefixListRequest
@@ -2334,7 +2334,7 @@ await _ec2.DeleteManagedPrefixListAsync(new DeleteManagedPrefixListRequest
         {
             PrefixListIds = [plId],
         });
-        desc.PrefixLists.ShouldBeEmpty();
+        (desc.PrefixLists ?? []).ShouldBeEmpty();
     }
 
     // ── Launch Template Tests ───────────────────────────────────────────────────
@@ -2395,7 +2395,7 @@ await _ec2.DeleteLaunchTemplateAsync(new DeleteLaunchTemplateRequest
         {
             LaunchTemplateIds = [ltId],
         });
-        desc3.LaunchTemplates.ShouldBeEmpty();
+        (desc3.LaunchTemplates ?? []).ShouldBeEmpty();
     }
 
     [Fact]
diff --git a/tests/MicroStack.Tests/IamTests.cs b/tests/MicroStack.Tests/IamTests.cs
index 23348a0..8d81f60 100644
--- a/tests/MicroStack.Tests/IamTests.cs
+++ b/tests/MicroStack.Tests/IamTests.cs
@@ -636,7 +636,7 @@ await _iam.UntagPolicyAsync(new UntagPolicyRequest
 
         var tags2 = await _iam.ListPolicyTagsAsync(
             new ListPolicyTagsRequest { PolicyArn = policyArn });
-        tags2.Tags.ShouldNotContain(t => t.Key == "env");
+        (tags2.Tags ?? []).ShouldNotContain(t => t.Key == "env");
     }
 
     // ── Update role ─────────────────────────────────────────────────────────────
@@ -902,6 +902,6 @@ await _iam.DetachUserPolicyAsync(new DetachUserPolicyRequest
                 EntityFilter = EntityType.Role,
             });
         (((resp3.PolicyRoles ?? []).Count >= 1)).ShouldBe(true);
-        resp3.PolicyUsers.ShouldBeEmpty();
+        (resp3.PolicyUsers ?? []).ShouldBeEmpty();
     }
 }
diff --git a/tests/MicroStack.Tests/PersistenceTests.cs b/tests/MicroStack.Tests/PersistenceTests.cs
index 863d335..0c7c2ca 100644
--- a/tests/MicroStack.Tests/PersistenceTests.cs
+++ b/tests/MicroStack.Tests/PersistenceTests.cs
@@ -179,7 +179,7 @@ public async Task SnsPersistRoundtrip()
         // Reset and verify topic is gone
         handler.Reset();
         var topics = await _sns.ListTopicsAsync();
-        topics.Topics.ShouldNotContain(t => t.TopicArn == created.TopicArn);
+        (topics.Topics ?? []).ShouldNotContain(t => t.TopicArn == created.TopicArn);
 
         // Restore and verify topic is back
         handler.RestoreState(state.Value);
@@ -304,7 +304,7 @@ await Should.ThrowAsync<QueueDoesNotExistException>(
             () => _sqs.GetQueueUrlAsync("persist-reset-q"));
 
         var topics = await _sns.ListTopicsAsync();
-        topics.Topics.ShouldBeEmpty();
+        (topics.Topics ?? []).ShouldBeEmpty();
 
         await Should.ThrowAsync<ParameterNotFoundException>(
             () => _ssm.GetParameterAsync(new GetParameterRequest { Name = "/persist/reset-key" }));
diff --git a/tests/MicroStack.Tests/RdsTests.cs b/tests/MicroStack.Tests/RdsTests.cs
index aa0dd82..820b0ae 100644
--- a/tests/MicroStack.Tests/RdsTests.cs
+++ b/tests/MicroStack.Tests/RdsTests.cs
@@ -663,7 +663,7 @@ await _rds.DeleteDBSnapshotAsync(new DeleteDBSnapshotRequest
         });
 
         var snaps2 = await _rds.DescribeDBSnapshotsAsync(new DescribeDBSnapshotsRequest());
-        snaps2.DBSnapshots.ShouldNotContain(s => s.DBSnapshotIdentifier == "qa-rds-snap-1");
+        (snaps2.DBSnapshots ?? []).ShouldNotContain(s => s.DBSnapshotIdentifier == "qa-rds-snap-1");
 
         await _rds.DeleteDBInstanceAsync(new DeleteDBInstanceRequest
         {
@@ -1030,7 +1030,7 @@ await _rds.RemoveFromGlobalClusterAsync(new RemoveFromGlobalClusterRequest
         {
             GlobalClusterIdentifier = "test-global-src",
         });
-        resp2.GlobalClusters[0].GlobalClusterMembers.ShouldBeEmpty();
+        (resp2.GlobalClusters[0].GlobalClusterMembers ?? []).ShouldBeEmpty();
 
         await _rds.DeleteGlobalClusterAsync(new DeleteGlobalClusterRequest
         {
diff --git a/tests/MicroStack.Tests/S3Tests.cs b/tests/MicroStack.Tests/S3Tests.cs
index a5e0776..ef2c5fd 100644
--- a/tests/MicroStack.Tests/S3Tests.cs
+++ b/tests/MicroStack.Tests/S3Tests.cs
@@ -91,7 +91,7 @@ public async Task DeleteBucket()
         await _s3.DeleteBucketAsync("del-bucket-test");
 
         var list = await _s3.ListBucketsAsync();
-        list.Buckets.ShouldNotContain(b => b.BucketName == "del-bucket-test");
+        (list.Buckets ?? []).ShouldNotContain(b => b.BucketName == "del-bucket-test");
     }
 
     [Fact]
@@ -285,7 +285,7 @@ public async Task ListObjectsV1()
         ((resp.CommonPrefixes ?? []).Count).ShouldBe(2);
         resp.CommonPrefixes!.ShouldContain("photos/2024/");
         resp.CommonPrefixes!.ShouldContain("photos/2025/");
-        resp.S3Objects.ShouldBeEmpty();
+        (resp.S3Objects ?? []).ShouldBeEmpty();
     }
 
     [Fact]
diff --git a/tests/MicroStack.Tests/SesTests.cs b/tests/MicroStack.Tests/SesTests.cs
index 200a717..3b9ecac 100644
--- a/tests/MicroStack.Tests/SesTests.cs
+++ b/tests/MicroStack.Tests/SesTests.cs
@@ -201,7 +201,7 @@ await _ses.DeleteIdentityAsync(new SesV1.Model.DeleteIdentityRequest
         });
 
         var resp = await _ses.ListIdentitiesAsync(new SesV1.Model.ListIdentitiesRequest());
-        resp.Identities.ShouldNotContain("delete@example.com");
+        (resp.Identities ?? []).ShouldNotContain("delete@example.com");
     }
 
     [Fact]
@@ -269,7 +269,7 @@ await _ses.DeleteConfigurationSetAsync(new SesV1.Model.DeleteConfigurationSetReq
         });
 
         var sets2 = await _ses.ListConfigurationSetsAsync(new SesV1.Model.ListConfigurationSetsRequest());
-        sets2.ConfigurationSets.ShouldNotContain(s => s.Name == "test-config");
+        (sets2.ConfigurationSets ?? []).ShouldNotContain(s => s.Name == "test-config");
     }
 
     // ═══════════════════════════════════════════════════════════════════════════
diff --git a/tests/MicroStack.Tests/SnsTests.cs b/tests/MicroStack.Tests/SnsTests.cs
index efac157..82396e6 100644
--- a/tests/MicroStack.Tests/SnsTests.cs
+++ b/tests/MicroStack.Tests/SnsTests.cs
@@ -454,7 +454,7 @@ public async Task PublishBatch()
         });
 
         (resp.Successful?.Count ?? 0).ShouldBe(3);
-        resp.Failed.ShouldBeEmpty();
+        (resp.Failed ?? []).ShouldBeEmpty();
     }
 
     [Fact]
@@ -512,7 +512,7 @@ await _sns.PublishAsync(new PublishRequest
             MaxNumberOfMessages = 1,
             WaitTimeSeconds = 0,
         });
-        msgs.Messages.ShouldBeEmpty();
+        (msgs.Messages ?? []).ShouldBeEmpty();
 
         // Publish matching message (blue)
         await _sns.PublishAsync(new PublishRequest