---¶
Install azemu and run your first terraform apply in minutes. No Azure account needed.
The metadata-redirect pattern, ARM fidelity, and what gets emulated under the hood.
Which Azure resources are supported and at what depth. Full transparency, no surprises.
A local Azure Portal for your emulator. Three views, live request streaming, embedded in the binary.
Quick start¶
# Start azemu (Azure ARM emulator + Azurite storage sidecar)
docker compose up -d --build
# Trust the self-signed cert for this shell
export SSL_CERT_FILE=$PWD/.azemu/cert-bundle.pem
# Run Terraform against the example stack
terraform -chdir=examples/terraform init
terraform -chdir=examples/terraform apply -auto-approve
azemu serves the standard Azure endpoints, so the same azurerm provider runs
unmodified under both Terraform and OpenTofu. Swap
terraform for tofu and everything works the same.
Prerequisites
Requires Docker, Docker Compose, and Terraform 1.6+ or OpenTofu 1.6+. See Your First Apply for the full walkthrough with expected output.
What azemu emulates today¶
Everything below round-trips a real terraform apply and destroy against
the unmodified azurerm provider. No subscription, no account, no network.
| Area | Resources |
|---|---|
| Networking | Resource Groups, Virtual Networks, Subnets, Public IPs, NSGs, Load Balancers, Application Gateways, DNS Zones (with record sets) |
| Storage & secrets | Storage Accounts + Blob containers (data plane via Azurite), Key Vault secrets and keys (including sign) |
| Compute & identity | User-Assigned Managed Identities, Federated Identity Credentials, AKS (management plane) |
| CDN & CI/CD | CDN Profiles and Endpoints (with a content data plane), Redis Cache, Azure DevOps OIDC + service connections |
See the Parity Matrix for the per-resource support depth, each row linked to the test that proves it.
Examples that solve real use cases¶
Each scenario is a full, working stack you can apply and destroy locally.
They double as integration tests, so they keep working.
- Three-tier web app: a web/app/data architecture built from networking resources.
- Static site with CDN and DNS: a static website on Storage behind a CDN profile and a custom DNS zone.
- DNS zone with records: a DNS zone with A, AAAA, CNAME, TXT, and MX record sets.
- Redis cache with Key Vault: a Redis cache whose connection string is stored in Key Vault, the read-from-secret pattern.
- AKS workload: management-plane provisioning for a workload that reads Key Vault secrets via workload identity.
- Azure DevOps pipeline: the ARM resources for an ADO pipeline that authenticates with workload identity federation (OIDC).
- Server-less OTA delivery: an end-to-end over-the-air update flow with a Key Vault-signed manifest, immutable Blob artefacts, and a CDN read path, verified locally with no compute on the read path.
What we are aiming for¶
Today azemu solves the resources and scenarios above end to end. The aim is to cover more of Azure so more teams can test their stack locally, and to keep raising fidelity on what already exists. Coverage grows from real demand, so the most useful thing you can do is tell us what you need:
- Open a feature request
naming the
azurermresource and the ARM provider path, or - Start a discussion with your use case.
Get involved¶
azemu is MIT-licensed, with no paid tier, no telemetry, and no account to create. If it is useful to you, a GitHub star helps other people find it.
Contributions of every size are welcome, and you do not need to be an Azure
or Go expert. Adding a resource, fixing a rejected apply, or sharpening a
doc page all help.