ARM Emulator

Local emulator of the Azure Resource Manager control plane in a single Go binary — subscriptions, resource groups, Microsoft.Authorization role definitions and role assignments with real scope inheritance, and Microsoft.KeyVault/vaults with their access policies.

The point: Microsoft’s own management clients run against it unmodified — the az CLI via az cloud register (the sovereign-cloud path), and the armresources / armauthorization / armkeyvault SDKs — and the assignments they write are genuinely enforced by the sibling data planes. az role assignment create decides whether azure-keyvault-emulator answers a secret read with 200 or 403.

Caution

Local development tool only — intentionally insecure (self-signed TLS, and ARM’s own surface authenticates but does not self-govern). It emulates the control-plane contract, not a security boundary. Run it on localhost only.

Start here

• Quickstart — bring up the pair, register the cloud, make an assignment that bites
• Installation — brew, winget, go install, Docker, compose
• Architecture — where this sits in the family, and the trust model
• Authorization — role definitions, assignments, scope inheritance, groups
• Microsoft.KeyVault — the vault resource and its access policies
• Microsoft.Fabric — capacities, the ARM resource fabric-emulator consumes
• The family feed — how a data plane learns what ARM decided
• Testing — the controllable clock, injected faults, and what CI verifies
• Parity — what is real, what is emulated, and what is deliberately absent