diff --git a/heat/engine/clients/os/keystone/fake_keystoneclient.py b/heat/engine/clients/os/keystone/fake_keystoneclient.py
new file mode 100644
index 0000000000..6e594ecfbd
--- /dev/null
+++ b/heat/engine/clients/os/keystone/fake_keystoneclient.py
@@ -0,0 +1,123 @@
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""A fake FakeKeystoneClient. This can be used during some runtime
+scenarios where you want to disable Heat's internal Keystone dependencies
+entirely. One example is the TripleO Undercloud installer.
+
+To use this class at runtime set to following heat.conf config setting:
+
+  keystone_backend = heat.engine.clients.os.keystone.fake_keystoneclient\
+  .FakeKeystoneClient
+
+"""
+
+from keystoneauth1 import session
+
+from heat.common import context
+
+
+class FakeKeystoneClient(object):
+    def __init__(self, username='test_username', password='password',
+                 user_id='1234', access='4567', secret='8901',
+                 credential_id='abcdxyz', auth_token='abcd1234',
+                 context=None, stack_domain_id='4321', client=None):
+        self.username = username
+        self.password = password
+        self.user_id = user_id
+        self.access = access
+        self.secret = secret
+        self.session = session.Session()
+        self.credential_id = credential_id
+        self.token = auth_token
+        self.context = context
+        self.v3_endpoint = 'http://localhost:5000/v3'
+        self.stack_domain_id = stack_domain_id
+        self.client = client
+
+        class FakeCred(object):
+            id = self.credential_id
+            access = self.access
+            secret = self.secret
+        self.creds = FakeCred()
+
+    def create_stack_user(self, username, password=''):
+        self.username = username
+        return self.user_id
+
+    def delete_stack_user(self, user_id):
+        self.user_id = None
+
+    def get_ec2_keypair(self, access, user_id):
+        if user_id == self.user_id:
+            if access == self.access:
+                return self.creds
+            else:
+                raise ValueError("Unexpected access %s" % access)
+        else:
+            raise ValueError("Unexpected user_id %s" % user_id)
+
+    def create_ec2_keypair(self, user_id):
+        if user_id == self.user_id:
+            return self.creds
+
+    def delete_ec2_keypair(self, credential_id=None, user_id=None,
+                           access=None):
+        if user_id == self.user_id and access == self.creds.access:
+            self.creds = None
+        else:
+            raise Exception('Incorrect user_id or access')
+
+    def enable_stack_user(self, user_id):
+        pass
+
+    def disable_stack_user(self, user_id):
+        pass
+
+    def create_trust_context(self):
+        return context.RequestContext(username=self.username,
+                                      password=self.password,
+                                      is_admin=False,
+                                      trust_id='atrust',
+                                      trustor_user_id=self.user_id)
+
+    def delete_trust(self, trust_id):
+        pass
+
+    def delete_stack_domain_project(self, project_id):
+        pass
+
+    def create_stack_domain_project(self, stack_id):
+        return 'aprojectid'
+
+    def create_stack_domain_user(self, username, project_id, password=None):
+        return self.user_id
+
+    def delete_stack_domain_user(self, user_id, project_id):
+        pass
+
+    def create_stack_domain_user_keypair(self, user_id, project_id):
+        return self.creds
+
+    def enable_stack_domain_user(self, user_id, project_id):
+        pass
+
+    def disable_stack_domain_user(self, user_id, project_id):
+        pass
+
+    def delete_stack_domain_user_keypair(self, user_id, project_id,
+                                         credential_id):
+        pass
+
+    def stack_domain_user_token(self, user_id, project_id, password):
+        return 'adomainusertoken'
diff --git a/heat/tests/aws/test_user.py b/heat/tests/aws/test_user.py
index be8f7d8bdb..04dcf0338e 100644
--- a/heat/tests/aws/test_user.py
+++ b/heat/tests/aws/test_user.py
@@ -17,6 +17,7 @@ from oslo_config import cfg
 from heat.common import exception
 from heat.common import short_id
 from heat.common import template_format
+from heat.engine.clients.os.keystone import fake_keystoneclient as fake_ks
 from heat.engine import node_data
 from heat.engine.resources.aws.iam import user
 from heat.engine.resources.openstack.heat import access_policy as ap
@@ -24,7 +25,6 @@ from heat.engine import scheduler
 from heat.engine import stk_defn
 from heat.objects import resource_data as resource_data_object
 from heat.tests import common
-from heat.tests import fakes
 from heat.tests import utils
 
 
@@ -109,7 +109,7 @@ class UserTest(common.HeatTestCase):
         super(UserTest, self).setUp()
         self.stack_name = 'test_user_stack_%s' % utils.random_name()
         self.username = '%s-CfnUser-aabbcc' % self.stack_name
-        self.fc = fakes.FakeKeystoneClient(username=self.username)
+        self.fc = fake_ks.FakeKeystoneClient(username=self.username)
         cfg.CONF.set_default('heat_stack_user_role', 'stack_user_role')
 
     def create_user(self, t, stack, resource_name,
@@ -118,9 +118,9 @@ class UserTest(common.HeatTestCase):
         self.m.StubOutWithMock(user.User, 'keystone')
         user.User.keystone().MultipleTimes().AndReturn(self.fc)
 
-        self.m.StubOutWithMock(fakes.FakeKeystoneClient,
+        self.m.StubOutWithMock(fake_ks.FakeKeystoneClient,
                                'create_stack_domain_project')
-        fakes.FakeKeystoneClient.create_stack_domain_project(
+        fake_ks.FakeKeystoneClient.create_stack_domain_project(
             stack.id).AndReturn(project_id)
 
         resource_defns = stack.t.resource_definitions(stack)
@@ -132,9 +132,9 @@ class UserTest(common.HeatTestCase):
         self.m.StubOutWithMock(short_id, 'get_id')
         short_id.get_id(rsrc.uuid).MultipleTimes().AndReturn('aabbcc')
 
-        self.m.StubOutWithMock(fakes.FakeKeystoneClient,
+        self.m.StubOutWithMock(fake_ks.FakeKeystoneClient,
                                'create_stack_domain_user')
-        fakes.FakeKeystoneClient.create_stack_domain_user(
+        fake_ks.FakeKeystoneClient.create_stack_domain_user(
             username=self.username, password=password,
             project_id=project_id).AndReturn(user_id)
         self.m.ReplayAll()
@@ -301,9 +301,9 @@ class AccessKeyTest(common.HeatTestCase):
         super(AccessKeyTest, self).setUp()
         self.username = utils.PhysName('test_stack', 'CfnUser')
         self.credential_id = 'acredential123'
-        self.fc = fakes.FakeKeystoneClient(username=self.username,
-                                           user_id='dummy_user',
-                                           credential_id=self.credential_id)
+        self.fc = fake_ks.FakeKeystoneClient(username=self.username,
+                                             user_id='dummy_user',
+                                             credential_id=self.credential_id)
         cfg.CONF.set_default('heat_stack_user_role', 'stack_user_role')
 
     def create_user(self, t, stack, resource_name,
diff --git a/heat/tests/clients/test_clients.py b/heat/tests/clients/test_clients.py
index 2a4c64311e..8ee8759836 100644
--- a/heat/tests/clients/test_clients.py
+++ b/heat/tests/clients/test_clients.py
@@ -36,6 +36,7 @@ from heat.common import exception
 from heat.engine import clients
 from heat.engine.clients import client_exception
 from heat.engine.clients import client_plugin
+from heat.engine.clients.os.keystone import fake_keystoneclient as fake_ks
 from heat.tests import common
 from heat.tests import fakes
 from heat.tests.openstack.nova import fakes as fakes_nova
@@ -257,7 +258,7 @@ class ClientPluginTest(common.HeatTestCase):
 
     @mock.patch.object(generic, "Token", name="v3_token")
     def test_get_missing_service_catalog(self, mock_v3):
-        class FakeKeystone(fakes.FakeKeystoneClient):
+        class FakeKeystone(fake_ks.FakeKeystoneClient):
             def __init__(self):
                 super(FakeKeystone, self).__init__()
                 self.client = self
@@ -285,7 +286,7 @@ class ClientPluginTest(common.HeatTestCase):
 
     @mock.patch.object(generic, "Token", name="v3_token")
     def test_endpoint_not_found(self, mock_v3):
-        class FakeKeystone(fakes.FakeKeystoneClient):
+        class FakeKeystone(fake_ks.FakeKeystoneClient):
             def __init__(self):
                 super(FakeKeystone, self).__init__()
                 self.client = self
diff --git a/heat/tests/common.py b/heat/tests/common.py
index 5642d98beb..413c3ec4ed 100644
--- a/heat/tests/common.py
+++ b/heat/tests/common.py
@@ -28,6 +28,7 @@ from heat.engine.clients.os import barbican
 from heat.engine.clients.os import cinder
 from heat.engine.clients.os import glance
 from heat.engine.clients.os import keystone
+from heat.engine.clients.os.keystone import fake_keystoneclient as fake_ks
 from heat.engine.clients.os.keystone import keystone_constraints as ks_constr
 from heat.engine.clients.os.neutron import neutron_constraints as neutron
 from heat.engine.clients.os import nova
@@ -220,7 +221,7 @@ class HeatTestCase(testscenarios.WithScenarios,
 
     def stub_keystoneclient(self, fake_client=None, **kwargs):
         client = self.patchobject(keystone.KeystoneClientPlugin, "_create")
-        fkc = fake_client or fakes.FakeKeystoneClient(**kwargs)
+        fkc = fake_client or fake_ks.FakeKeystoneClient(**kwargs)
         client.return_value = fkc
         return fkc
 
diff --git a/heat/tests/engine/service/test_stack_resources.py b/heat/tests/engine/service/test_stack_resources.py
index 35ce2131ff..dfc19ba4ec 100644
--- a/heat/tests/engine/service/test_stack_resources.py
+++ b/heat/tests/engine/service/test_stack_resources.py
@@ -18,6 +18,7 @@ import six
 from heat.common import exception
 from heat.common import identifier
 from heat.engine.clients.os import keystone
+from heat.engine.clients.os.keystone import fake_keystoneclient as fake_ks
 from heat.engine import dependencies
 from heat.engine import resource as res
 from heat.engine.resources.aws.ec2 import instance as ins
@@ -28,7 +29,6 @@ from heat.engine import template as templatem
 from heat.objects import stack as stack_object
 from heat.tests import common
 from heat.tests.engine import tools
-from heat.tests import fakes as test_fakes
 from heat.tests import generic_resource as generic_rsrc
 from heat.tests import utils
 
@@ -319,7 +319,7 @@ class StackResourcesServiceTest(common.HeatTestCase):
 
     def _stack_create(self, stack_name):
         self.patchobject(keystone.KeystoneClientPlugin, '_create',
-                         return_value=test_fakes.FakeKeystoneClient())
+                         return_value=fake_ks.FakeKeystoneClient())
 
         stk = tools.get_stack(stack_name, self.ctx, policy_template)
         stk.store()
@@ -457,7 +457,7 @@ class StackResourcesServiceTest(common.HeatTestCase):
                                           mock_update):
         # fake keystone client
         self.patchobject(keystone.KeystoneClientPlugin, '_create',
-                         return_value=test_fakes.FakeKeystoneClient())
+                         return_value=fake_ks.FakeKeystoneClient())
 
         stk = tools.get_stack('signal_reception', self.ctx, policy_template)
         self.stack = stk
@@ -485,7 +485,7 @@ class StackResourcesServiceTest(common.HeatTestCase):
                                              mock_update):
         # fake keystone client
         self.patchobject(keystone.KeystoneClientPlugin, '_create',
-                         return_value=test_fakes.FakeKeystoneClient())
+                         return_value=fake_ks.FakeKeystoneClient())
 
         stk = tools.get_stack('signal_reception', self.ctx, policy_template)
         self.stack = stk
diff --git a/heat/tests/engine/tools.py b/heat/tests/engine/tools.py
index 08c12e733c..6e38376617 100644
--- a/heat/tests/engine/tools.py
+++ b/heat/tests/engine/tools.py
@@ -18,12 +18,12 @@ import six
 from heat.common import template_format
 from heat.engine.clients.os import glance
 from heat.engine.clients.os import keystone
+from heat.engine.clients.os.keystone import fake_keystoneclient as fake_ks
 from heat.engine.clients.os import nova
 from heat.engine import environment
 from heat.engine.resources.aws.ec2 import instance as instances
 from heat.engine import stack as parser
 from heat.engine import template as templatem
-from heat.tests import fakes as test_fakes
 from heat.tests.openstack.nova import fakes as fakes_nova
 from heat.tests import utils
 
@@ -169,7 +169,7 @@ def get_stack(stack_name, ctx, template=None, with_params=True,
 
 
 def setup_keystone_mocks(mocks, stack):
-    fkc = test_fakes.FakeKeystoneClient()
+    fkc = fake_ks.FakeKeystoneClient()
 
     mocks.StubOutWithMock(keystone.KeystoneClientPlugin, '_create')
     keystone.KeystoneClientPlugin._create().AndReturn(fkc)
diff --git a/heat/tests/fakes.py b/heat/tests/fakes.py
index 490fc807b5..63fd86a8eb 100644
--- a/heat/tests/fakes.py
+++ b/heat/tests/fakes.py
@@ -19,11 +19,8 @@ places where actual behavior differs from the spec.
 """
 
 from keystoneauth1 import plugin
-from keystoneauth1 import session
 import mock
 
-from heat.common import context
-
 
 class FakeClient(object):
 
@@ -97,102 +94,6 @@ class FakeAuth(plugin.BaseAuthPlugin):
         return FakeAccessInfo([], None, None)
 
 
-class FakeKeystoneClient(object):
-    def __init__(self, username='test_username', password='password',
-                 user_id='1234', access='4567', secret='8901',
-                 credential_id='abcdxyz', auth_token='abcd1234',
-                 context=None, stack_domain_id='4321', client=None):
-        self.username = username
-        self.password = password
-        self.user_id = user_id
-        self.access = access
-        self.secret = secret
-        self.session = session.Session()
-        self.credential_id = credential_id
-        self.token = auth_token
-        self.context = context
-        self.v3_endpoint = 'http://localhost:5000/v3'
-        self.stack_domain_id = stack_domain_id
-        self.client = client
-
-        class FakeCred(object):
-            id = self.credential_id
-            access = self.access
-            secret = self.secret
-        self.creds = FakeCred()
-
-    def create_stack_user(self, username, password=''):
-        self.username = username
-        return self.user_id
-
-    def delete_stack_user(self, user_id):
-        self.user_id = None
-
-    def get_ec2_keypair(self, access, user_id):
-        if user_id == self.user_id:
-            if access == self.access:
-                return self.creds
-            else:
-                raise ValueError("Unexpected access %s" % access)
-        else:
-            raise ValueError("Unexpected user_id %s" % user_id)
-
-    def create_ec2_keypair(self, user_id):
-        if user_id == self.user_id:
-            return self.creds
-
-    def delete_ec2_keypair(self, credential_id=None, user_id=None,
-                           access=None):
-        if user_id == self.user_id and access == self.creds.access:
-            self.creds = None
-        else:
-            raise Exception('Incorrect user_id or access')
-
-    def enable_stack_user(self, user_id):
-        pass
-
-    def disable_stack_user(self, user_id):
-        pass
-
-    def create_trust_context(self):
-        return context.RequestContext(username=self.username,
-                                      password=self.password,
-                                      is_admin=False,
-                                      trust_id='atrust',
-                                      trustor_user_id=self.user_id)
-
-    def delete_trust(self, trust_id):
-        pass
-
-    def delete_stack_domain_project(self, project_id):
-        pass
-
-    def create_stack_domain_project(self, stack_id):
-        return 'aprojectid'
-
-    def create_stack_domain_user(self, username, project_id, password=None):
-        return self.user_id
-
-    def delete_stack_domain_user(self, user_id, project_id):
-        pass
-
-    def create_stack_domain_user_keypair(self, user_id, project_id):
-        return self.creds
-
-    def enable_stack_domain_user(self, user_id, project_id):
-        pass
-
-    def disable_stack_domain_user(self, user_id, project_id):
-        pass
-
-    def delete_stack_domain_user_keypair(self, user_id, project_id,
-                                         credential_id):
-        pass
-
-    def stack_domain_user_token(self, user_id, project_id, password):
-        return 'adomainusertoken'
-
-
 class FakeAccessInfo(object):
     def __init__(self, roles, user_domain, project_domain):
         self.roles = roles
diff --git a/heat/tests/openstack/keystone/test_domain.py b/heat/tests/openstack/keystone/test_domain.py
index dd5420c065..bf8cb87c4f 100644
--- a/heat/tests/openstack/keystone/test_domain.py
+++ b/heat/tests/openstack/keystone/test_domain.py
@@ -13,12 +13,12 @@
 
 import mock
 
+from heat.engine.clients.os.keystone import fake_keystoneclient as fake_ks
 from heat.engine import resource
 from heat.engine.resources.openstack.keystone import domain
 from heat.engine import stack
 from heat.engine import template
 from heat.tests import common
-from heat.tests import fakes
 from heat.tests import utils
 
 KEYSTONE_REGION_TEMPLATE = {
@@ -54,7 +54,7 @@ class KeystoneDomainTest(common.HeatTestCase):
         # Mock client
         self.keystoneclient = mock.Mock()
         self.patchobject(resource.Resource, 'client',
-                         return_value=fakes.FakeKeystoneClient(
+                         return_value=fake_ks.FakeKeystoneClient(
                              client=self.keystoneclient))
         self.domains = self.keystoneclient.domains
 
diff --git a/heat/tests/openstack/keystone/test_endpoint.py b/heat/tests/openstack/keystone/test_endpoint.py
index 9accc4cd60..dc0e4f169c 100644
--- a/heat/tests/openstack/keystone/test_endpoint.py
+++ b/heat/tests/openstack/keystone/test_endpoint.py
@@ -15,6 +15,7 @@ import copy
 
 import mock
 
+from heat.engine.clients.os.keystone import fake_keystoneclient as fake_ks
 from heat.engine import constraints
 from heat.engine import properties
 from heat.engine import resource
@@ -22,7 +23,6 @@ from heat.engine.resources.openstack.keystone import endpoint
 from heat.engine import stack
 from heat.engine import template
 from heat.tests import common
-from heat.tests import fakes
 from heat.tests import utils
 
 keystone_endpoint_template = {
@@ -54,7 +54,7 @@ class KeystoneEndpointTest(common.HeatTestCase):
         # Mock client
         self.keystoneclient = mock.Mock()
         self.patchobject(resource.Resource, 'client',
-                         return_value=fakes.FakeKeystoneClient(
+                         return_value=fake_ks.FakeKeystoneClient(
                              client=self.keystoneclient))
         self.endpoints = self.keystoneclient.endpoints
 
diff --git a/heat/tests/openstack/keystone/test_group.py b/heat/tests/openstack/keystone/test_group.py
index a6f53b2cc7..7d689d8580 100644
--- a/heat/tests/openstack/keystone/test_group.py
+++ b/heat/tests/openstack/keystone/test_group.py
@@ -13,6 +13,7 @@
 
 import mock
 
+from heat.engine.clients.os.keystone import fake_keystoneclient as fake_ks
 from heat.engine import constraints
 from heat.engine import properties
 from heat.engine import resource
@@ -20,7 +21,6 @@ from heat.engine.resources.openstack.keystone import group
 from heat.engine import stack
 from heat.engine import template
 from heat.tests import common
-from heat.tests import fakes
 from heat.tests import utils
 
 keystone_group_template = {
@@ -56,7 +56,7 @@ class KeystoneGroupTest(common.HeatTestCase):
         # Mock client
         self.keystoneclient = mock.Mock()
         self.patchobject(resource.Resource, 'client',
-                         return_value=fakes.FakeKeystoneClient(
+                         return_value=fake_ks.FakeKeystoneClient(
                              client=self.keystoneclient))
         self.groups = self.keystoneclient.groups
         self.role_assignments = self.keystoneclient.role_assignments
diff --git a/heat/tests/openstack/keystone/test_region.py b/heat/tests/openstack/keystone/test_region.py
index 92169e2ec0..81069c8753 100644
--- a/heat/tests/openstack/keystone/test_region.py
+++ b/heat/tests/openstack/keystone/test_region.py
@@ -14,12 +14,12 @@
 import mock
 from six.moves.urllib import parse
 
+from heat.engine.clients.os.keystone import fake_keystoneclient as fake_ks
 from heat.engine import resource
 from heat.engine.resources.openstack.keystone import region
 from heat.engine import stack
 from heat.engine import template
 from heat.tests import common
-from heat.tests import fakes
 from heat.tests import utils
 
 KEYSTONE_REGION_TEMPLATE = {
@@ -56,7 +56,7 @@ class KeystoneRegionTest(common.HeatTestCase):
         # Mock client
         self.keystoneclient = mock.Mock()
         self.patchobject(resource.Resource, 'client',
-                         return_value=fakes.FakeKeystoneClient(
+                         return_value=fake_ks.FakeKeystoneClient(
                              client=self.keystoneclient))
         self.regions = self.keystoneclient.regions
 
diff --git a/heat/tests/openstack/keystone/test_role.py b/heat/tests/openstack/keystone/test_role.py
index 258308d369..445ef9e4b0 100644
--- a/heat/tests/openstack/keystone/test_role.py
+++ b/heat/tests/openstack/keystone/test_role.py
@@ -14,12 +14,12 @@
 import copy
 import mock
 
+from heat.engine.clients.os.keystone import fake_keystoneclient as fake_ks
 from heat.engine import resource
 from heat.engine.resources.openstack.keystone import role
 from heat.engine import stack
 from heat.engine import template
 from heat.tests import common
-from heat.tests import fakes
 from heat.tests import utils
 
 keystone_role_template = {
@@ -45,7 +45,7 @@ class KeystoneRoleTest(common.HeatTestCase):
         # Mock client
         self.keystoneclient = mock.Mock()
         self.patchobject(resource.Resource, 'client',
-                         return_value=fakes.FakeKeystoneClient(
+                         return_value=fake_ks.FakeKeystoneClient(
                              client=self.keystoneclient))
         self.roles = self.keystoneclient.roles
 
diff --git a/heat/tests/openstack/keystone/test_role_assignments.py b/heat/tests/openstack/keystone/test_role_assignments.py
index dae1820e1e..a2f2358667 100644
--- a/heat/tests/openstack/keystone/test_role_assignments.py
+++ b/heat/tests/openstack/keystone/test_role_assignments.py
@@ -15,13 +15,13 @@ import copy
 import mock
 
 from heat.common import exception
+from heat.engine.clients.os.keystone import fake_keystoneclient as fake_ks
 from heat.engine import properties
 from heat.engine import resource
 from heat.engine.resources.openstack.keystone import role_assignments
 from heat.engine import stack
 from heat.engine import template
 from heat.tests import common
-from heat.tests import fakes
 from heat.tests import generic_resource
 from heat.tests import utils
 
@@ -429,7 +429,7 @@ class KeystoneUserRoleAssignmentTest(common.HeatTestCase):
         # Mock client
         self.keystoneclient = mock.Mock()
         self.patchobject(resource.Resource, 'client',
-                         return_value=fakes.FakeKeystoneClient(
+                         return_value=fake_ks.FakeKeystoneClient(
                              client=self.keystoneclient))
         self.roles = self.keystoneclient.roles
 
@@ -558,7 +558,7 @@ class KeystoneGroupRoleAssignmentTest(common.HeatTestCase):
         # Mock client
         self.keystoneclient = mock.Mock()
         self.patchobject(resource.Resource, 'client',
-                         return_value=fakes.FakeKeystoneClient(
+                         return_value=fake_ks.FakeKeystoneClient(
                              client=self.keystoneclient))
         self.roles = self.keystoneclient.roles
 
diff --git a/heat/tests/openstack/keystone/test_service.py b/heat/tests/openstack/keystone/test_service.py
index 4b6e129445..7eb643f540 100644
--- a/heat/tests/openstack/keystone/test_service.py
+++ b/heat/tests/openstack/keystone/test_service.py
@@ -15,13 +15,13 @@ import copy
 
 import mock
 
+from heat.engine.clients.os.keystone import fake_keystoneclient as fake_ks
 from heat.engine import properties
 from heat.engine import resource
 from heat.engine.resources.openstack.keystone import service
 from heat.engine import stack
 from heat.engine import template
 from heat.tests import common
-from heat.tests import fakes
 from heat.tests import utils
 
 keystone_service_template = {
@@ -51,7 +51,7 @@ class KeystoneServiceTest(common.HeatTestCase):
         # Mock client
         self.keystoneclient = mock.Mock()
         self.patchobject(resource.Resource, 'client',
-                         return_value=fakes.FakeKeystoneClient(
+                         return_value=fake_ks.FakeKeystoneClient(
                              client=self.keystoneclient))
         self.services = self.keystoneclient.services
 
diff --git a/heat/tests/openstack/keystone/test_user.py b/heat/tests/openstack/keystone/test_user.py
index 01159d4785..a95aa0af46 100644
--- a/heat/tests/openstack/keystone/test_user.py
+++ b/heat/tests/openstack/keystone/test_user.py
@@ -13,12 +13,12 @@
 
 import mock
 
+from heat.engine.clients.os.keystone import fake_keystoneclient as fake_ks
 from heat.engine import resource
 from heat.engine.resources.openstack.keystone import user
 from heat.engine import stack
 from heat.engine import template
 from heat.tests import common
-from heat.tests import fakes
 from heat.tests import utils
 
 keystone_user_template = {
@@ -60,7 +60,7 @@ class KeystoneUserTest(common.HeatTestCase):
         # Mock client
         self.keystoneclient = mock.Mock()
         self.patchobject(resource.Resource, 'client',
-                         return_value=fakes.FakeKeystoneClient(
+                         return_value=fake_ks.FakeKeystoneClient(
                              client=self.keystoneclient))
         self.users = self.keystoneclient.users
 
diff --git a/heat/tests/test_signal.py b/heat/tests/test_signal.py
index a5bdaf600f..ec4f17e102 100644
--- a/heat/tests/test_signal.py
+++ b/heat/tests/test_signal.py
@@ -22,13 +22,13 @@ from heat.common import exception
 from heat.common import template_format
 from heat.db.sqlalchemy import models
 from heat.engine.clients.os import heat_plugin
+from heat.engine.clients.os.keystone import fake_keystoneclient as fake_ks
 from heat.engine.clients.os import swift
 from heat.engine import scheduler
 from heat.engine import stack as stk
 from heat.engine import template
 from heat.objects import resource_data as resource_data_object
 from heat.tests import common
-from heat.tests import fakes
 from heat.tests import generic_resource
 from heat.tests import utils
 
@@ -467,7 +467,7 @@ class SignalTest(common.HeatTestCase):
 
     def test_delete_not_found(self):
         # Setup
-        class FakeKeystoneClientFail(fakes.FakeKeystoneClient):
+        class FakeKeystoneClientFail(fake_ks.FakeKeystoneClient):
             def delete_stack_user(self, name):
                 raise kc_exceptions.NotFound()
         self.stub_keystoneclient(fake_client=FakeKeystoneClientFail())
diff --git a/heat/tests/test_stack.py b/heat/tests/test_stack.py
index cac03a78ac..1b59fc4229 100644
--- a/heat/tests/test_stack.py
+++ b/heat/tests/test_stack.py
@@ -31,6 +31,7 @@ from heat.common import template_format
 from heat.common import timeutils
 from heat.db.sqlalchemy import api as db_api
 from heat.engine.clients.os import keystone
+from heat.engine.clients.os.keystone import fake_keystoneclient as fake_ks
 from heat.engine.clients.os import nova
 from heat.engine import environment
 from heat.engine import function
@@ -1485,9 +1486,9 @@ class StackTest(common.HeatTestCase):
 
         self.m.StubOutWithMock(keystone.KeystoneClientPlugin, '_create')
         keystone.KeystoneClientPlugin._create().AndReturn(
-            fakes.FakeKeystoneClient(user_id='auser123'))
+            fake_ks.FakeKeystoneClient(user_id='auser123'))
         keystone.KeystoneClientPlugin._create().AndReturn(
-            fakes.FakeKeystoneClient(user_id='auser123'))
+            fake_ks.FakeKeystoneClient(user_id='auser123'))
         self.m.ReplayAll()
 
         self.stack = stack.Stack(self.ctx, 'creds_stack', self.tmpl)
diff --git a/heat/tests/test_stack_delete.py b/heat/tests/test_stack_delete.py
index aa9b8163a5..a24cc14a5e 100644
--- a/heat/tests/test_stack_delete.py
+++ b/heat/tests/test_stack_delete.py
@@ -23,6 +23,7 @@ from heat.common import exception
 from heat.common import template_format
 from heat.common import timeutils
 from heat.engine.clients.os import keystone
+from heat.engine.clients.os.keystone import fake_keystoneclient as fake_ks
 from heat.engine.clients.os.keystone import heat_keystoneclient as hkc
 from heat.engine import scheduler
 from heat.engine import stack
@@ -31,7 +32,6 @@ from heat.objects import snapshot as snapshot_object
 from heat.objects import stack as stack_object
 from heat.objects import user_creds as ucreds_object
 from heat.tests import common
-from heat.tests import fakes
 from heat.tests import generic_resource as generic_rsrc
 from heat.tests import utils
 
@@ -272,7 +272,7 @@ class StackTest(common.HeatTestCase):
             self.ctx, user_creds_id)
         self.assertEqual('thetrustor', user_creds.get('trustor_user_id'))
 
-        mock_kc.return_value = fakes.FakeKeystoneClient(user_id='nottrustor')
+        mock_kc.return_value = fake_ks.FakeKeystoneClient(user_id='nottrustor')
 
         loaded_stack = stack.Stack.load(other_ctx, self.stack.id)
         loaded_stack.delete()
@@ -284,7 +284,7 @@ class StackTest(common.HeatTestCase):
                          loaded_stack.state)
 
     def test_delete_trust_backup(self):
-        class FakeKeystoneClientFail(fakes.FakeKeystoneClient):
+        class FakeKeystoneClientFail(fake_ks.FakeKeystoneClient):
             def delete_trust(self, trust_id):
                 raise Exception("Shouldn't delete")
 
@@ -306,7 +306,7 @@ class StackTest(common.HeatTestCase):
         mock_kcp.assert_called_once_with()
 
     def test_delete_trust_nested(self):
-        class FakeKeystoneClientFail(fakes.FakeKeystoneClient):
+        class FakeKeystoneClientFail(fake_ks.FakeKeystoneClient):
             def delete_trust(self, trust_id):
                 raise Exception("Shouldn't delete")
 
@@ -335,7 +335,7 @@ class StackTest(common.HeatTestCase):
                          self.stack.state)
 
     def test_delete_trust_fail(self):
-        class FakeKeystoneClientFail(fakes.FakeKeystoneClient):
+        class FakeKeystoneClientFail(fake_ks.FakeKeystoneClient):
             def delete_trust(self, trust_id):
                 raise kc_exceptions.Forbidden("Denied!")
 
@@ -360,7 +360,7 @@ class StackTest(common.HeatTestCase):
         self.assertIn('Error deleting trust', self.stack.status_reason)
 
     def test_delete_deletes_project(self):
-        fkc = fakes.FakeKeystoneClient()
+        fkc = fake_ks.FakeKeystoneClient()
         fkc.delete_stack_domain_project = mock.Mock()
 
         mock_kcp = self.patchobject(keystone.KeystoneClientPlugin, '_create',
@@ -489,7 +489,7 @@ class StackTest(common.HeatTestCase):
 
     def test_stack_user_project_id_delete_fail(self):
 
-        class FakeKeystoneClientFail(fakes.FakeKeystoneClient):
+        class FakeKeystoneClientFail(fake_ks.FakeKeystoneClient):
             def delete_stack_domain_project(self, project_id):
                 raise kc_exceptions.Forbidden("Denied!")
 
diff --git a/heat/tests/test_stack_user.py b/heat/tests/test_stack_user.py
index 4effcf79af..a698e530ab 100644
--- a/heat/tests/test_stack_user.py
+++ b/heat/tests/test_stack_user.py
@@ -17,11 +17,11 @@ import six
 from heat.common import exception
 from heat.common import short_id
 from heat.common import template_format
+from heat.engine.clients.os.keystone import fake_keystoneclient as fake_ks
 from heat.engine.resources import stack_user
 from heat.engine import scheduler
 from heat.objects import resource_data as resource_data_object
 from heat.tests import common
-from heat.tests import fakes
 from heat.tests import utils
 
 
@@ -38,7 +38,7 @@ class StackUserTest(common.HeatTestCase):
 
     def setUp(self):
         super(StackUserTest, self).setUp()
-        self.fc = fakes.FakeKeystoneClient()
+        self.fc = fake_ks.FakeKeystoneClient()
 
     def _user_create(self, stack_name, project_id, user_id,
                      resource_name='user', create_project=True,
@@ -51,9 +51,9 @@ class StackUserTest(common.HeatTestCase):
         stack_user.StackUser.keystone().MultipleTimes().AndReturn(self.fc)
 
         if create_project:
-            self.m.StubOutWithMock(fakes.FakeKeystoneClient,
+            self.m.StubOutWithMock(fake_ks.FakeKeystoneClient,
                                    'create_stack_domain_project')
-            fakes.FakeKeystoneClient.create_stack_domain_project(
+            fake_ks.FakeKeystoneClient.create_stack_domain_project(
                 self.stack.id).AndReturn(project_id)
         else:
             self.stack.set_stack_user_project_id(project_id)
@@ -62,10 +62,10 @@ class StackUserTest(common.HeatTestCase):
         self.m.StubOutWithMock(short_id, 'get_id')
         short_id.get_id(rsrc.uuid).MultipleTimes().AndReturn('aabbcc')
 
-        self.m.StubOutWithMock(fakes.FakeKeystoneClient,
+        self.m.StubOutWithMock(fake_ks.FakeKeystoneClient,
                                'create_stack_domain_user')
         expected_username = '%s-%s-%s' % (stack_name, resource_name, 'aabbcc')
-        fakes.FakeKeystoneClient.create_stack_domain_user(
+        fake_ks.FakeKeystoneClient.create_stack_domain_user(
             username=expected_username, password=password,
             project_id=project_id).AndReturn(user_id)
 
@@ -101,9 +101,9 @@ class StackUserTest(common.HeatTestCase):
                                  project_id='aprojectdel',
                                  user_id='auserdel')
 
-        self.m.StubOutWithMock(fakes.FakeKeystoneClient,
+        self.m.StubOutWithMock(fake_ks.FakeKeystoneClient,
                                'delete_stack_domain_user')
-        fakes.FakeKeystoneClient.delete_stack_domain_user(
+        fake_ks.FakeKeystoneClient.delete_stack_domain_user(
             user_id='auserdel', project_id='aprojectdel').AndReturn(None)
 
         self.m.ReplayAll()
@@ -119,9 +119,9 @@ class StackUserTest(common.HeatTestCase):
                                  project_id='aprojectdel2',
                                  user_id='auserdel2')
 
-        self.m.StubOutWithMock(fakes.FakeKeystoneClient,
+        self.m.StubOutWithMock(fake_ks.FakeKeystoneClient,
                                'delete_stack_domain_user')
-        fakes.FakeKeystoneClient.delete_stack_domain_user(
+        fake_ks.FakeKeystoneClient.delete_stack_domain_user(
             user_id='auserdel2', project_id='aprojectdel2').AndRaise(
                 kc_exceptions.NotFound)
 
@@ -152,9 +152,9 @@ class StackUserTest(common.HeatTestCase):
                                  project_id='aprojectdel',
                                  user_id='auserdel')
 
-        self.m.StubOutWithMock(fakes.FakeKeystoneClient,
+        self.m.StubOutWithMock(fake_ks.FakeKeystoneClient,
                                'disable_stack_domain_user')
-        fakes.FakeKeystoneClient.disable_stack_domain_user(
+        fake_ks.FakeKeystoneClient.disable_stack_domain_user(
             user_id='auserdel', project_id='aprojectdel').AndReturn(None)
 
         self.m.ReplayAll()
@@ -170,13 +170,13 @@ class StackUserTest(common.HeatTestCase):
                                  project_id='aprojectdel',
                                  user_id='auserdel')
 
-        self.m.StubOutWithMock(fakes.FakeKeystoneClient,
+        self.m.StubOutWithMock(fake_ks.FakeKeystoneClient,
                                'disable_stack_domain_user')
-        fakes.FakeKeystoneClient.disable_stack_domain_user(
+        fake_ks.FakeKeystoneClient.disable_stack_domain_user(
             user_id='auserdel', project_id='aprojectdel').AndRaise(ValueError)
-        self.m.StubOutWithMock(fakes.FakeKeystoneClient,
+        self.m.StubOutWithMock(fake_ks.FakeKeystoneClient,
                                'disable_stack_user')
-        fakes.FakeKeystoneClient.disable_stack_user(
+        fake_ks.FakeKeystoneClient.disable_stack_user(
             user_id='auserdel').AndReturn(None)
 
         self.m.ReplayAll()
@@ -192,9 +192,9 @@ class StackUserTest(common.HeatTestCase):
                                  project_id='aprojectdel',
                                  user_id='auserdel')
 
-        self.m.StubOutWithMock(fakes.FakeKeystoneClient,
+        self.m.StubOutWithMock(fake_ks.FakeKeystoneClient,
                                'enable_stack_domain_user')
-        fakes.FakeKeystoneClient.enable_stack_domain_user(
+        fake_ks.FakeKeystoneClient.enable_stack_domain_user(
             user_id='auserdel', project_id='aprojectdel').AndReturn(None)
 
         self.m.ReplayAll()
@@ -211,13 +211,13 @@ class StackUserTest(common.HeatTestCase):
                                  project_id='aprojectdel',
                                  user_id='auserdel')
 
-        self.m.StubOutWithMock(fakes.FakeKeystoneClient,
+        self.m.StubOutWithMock(fake_ks.FakeKeystoneClient,
                                'enable_stack_domain_user')
-        fakes.FakeKeystoneClient.enable_stack_domain_user(
+        fake_ks.FakeKeystoneClient.enable_stack_domain_user(
             user_id='auserdel', project_id='aprojectdel').AndRaise(ValueError)
-        self.m.StubOutWithMock(fakes.FakeKeystoneClient,
+        self.m.StubOutWithMock(fake_ks.FakeKeystoneClient,
                                'enable_stack_user')
-        fakes.FakeKeystoneClient.enable_stack_user(
+        fake_ks.FakeKeystoneClient.enable_stack_user(
             user_id='auserdel').AndReturn(None)
 
         self.m.ReplayAll()
@@ -235,9 +235,9 @@ class StackUserTest(common.HeatTestCase):
                                  user_id='auserdel')
 
         # create_stack_domain_user_keypair(self, user_id, project_id):
-        self.m.StubOutWithMock(fakes.FakeKeystoneClient,
+        self.m.StubOutWithMock(fake_ks.FakeKeystoneClient,
                                'create_stack_domain_user_keypair')
-        fakes.FakeKeystoneClient.create_stack_domain_user_keypair(
+        fake_ks.FakeKeystoneClient.create_stack_domain_user_keypair(
             user_id='auserdel', project_id='aprojectdel').AndReturn(
                 self.fc.creds)
         self.m.ReplayAll()
@@ -260,9 +260,9 @@ class StackUserTest(common.HeatTestCase):
                                  user_id='auserdel')
 
         # create_stack_domain_user_keypair(self, user_id, project_id):
-        self.m.StubOutWithMock(fakes.FakeKeystoneClient,
+        self.m.StubOutWithMock(fake_ks.FakeKeystoneClient,
                                'create_stack_domain_user_keypair')
-        fakes.FakeKeystoneClient.create_stack_domain_user_keypair(
+        fake_ks.FakeKeystoneClient.create_stack_domain_user_keypair(
             user_id='auserdel', project_id='aprojectdel').AndReturn(None)
         self.m.ReplayAll()
 
@@ -276,9 +276,9 @@ class StackUserTest(common.HeatTestCase):
                                  project_id='aprojectdel',
                                  user_id='auserdel')
 
-        self.m.StubOutWithMock(fakes.FakeKeystoneClient,
+        self.m.StubOutWithMock(fake_ks.FakeKeystoneClient,
                                'delete_stack_domain_user_keypair')
-        fakes.FakeKeystoneClient.delete_stack_domain_user_keypair(
+        fake_ks.FakeKeystoneClient.delete_stack_domain_user_keypair(
             user_id='auserdel', project_id='aprojectdel',
             credential_id='acredential').AndReturn(None)
         self.m.ReplayAll()
@@ -304,14 +304,14 @@ class StackUserTest(common.HeatTestCase):
                                  project_id='aprojectdel',
                                  user_id='auserdel')
 
-        self.m.StubOutWithMock(fakes.FakeKeystoneClient,
+        self.m.StubOutWithMock(fake_ks.FakeKeystoneClient,
                                'delete_stack_domain_user_keypair')
-        fakes.FakeKeystoneClient.delete_stack_domain_user_keypair(
+        fake_ks.FakeKeystoneClient.delete_stack_domain_user_keypair(
             user_id='auserdel', project_id='aprojectdel',
             credential_id='acredential').AndRaise(ValueError())
-        self.m.StubOutWithMock(fakes.FakeKeystoneClient,
+        self.m.StubOutWithMock(fake_ks.FakeKeystoneClient,
                                'delete_ec2_keypair')
-        fakes.FakeKeystoneClient.delete_ec2_keypair(
+        fake_ks.FakeKeystoneClient.delete_ec2_keypair(
             user_id='auserdel', credential_id='acredential').AndReturn(None)
         self.m.ReplayAll()
 
@@ -330,9 +330,9 @@ class StackUserTest(common.HeatTestCase):
                                  project_id='aprojectdel',
                                  user_id='auserdel')
 
-        self.m.StubOutWithMock(fakes.FakeKeystoneClient,
+        self.m.StubOutWithMock(fake_ks.FakeKeystoneClient,
                                'delete_stack_domain_user_keypair')
-        fakes.FakeKeystoneClient.delete_stack_domain_user_keypair(
+        fake_ks.FakeKeystoneClient.delete_stack_domain_user_keypair(
             user_id='auserdel', project_id='aprojectdel',
             credential_id='acredential').AndReturn(None)
         self.m.ReplayAll()
@@ -351,9 +351,9 @@ class StackUserTest(common.HeatTestCase):
                                  user_id='aabbcc',
                                  password='apassword')
 
-        self.m.StubOutWithMock(fakes.FakeKeystoneClient,
+        self.m.StubOutWithMock(fake_ks.FakeKeystoneClient,
                                'stack_domain_user_token')
-        fakes.FakeKeystoneClient.stack_domain_user_token(
+        fake_ks.FakeKeystoneClient.stack_domain_user_token(
             user_id='aabbcc', project_id='aproject123',
             password='apassword').AndReturn('atoken123')
         self.m.ReplayAll()