Mockingbird

Amazon Identity and Access Management

@crvouga/mockingbird-service-iam

Stateful Amazon Identity and Access Management emulator with AWS SDK wire compatibility and deterministic local controls.

Parity: Documented operations; LocalStack differential scenariosIdentity7 of 7 operationsIn-process fetchNode servermockingbird-iam
$
npm install -D @crvouga/mockingbird-service-iam
Source npm MarkdownAgent discoverySUPPORT.md

Playground

Requests go to the real emulator running in this tab. State persists across requests, and the journal shows what it received. A green dot marks operations whose sample succeeds as-is; others need ids from earlier responses.

Loads the real @crvouga/mockingbird-service-iam into this tab on first send
https://iam.us-east-1.amazonaws.com

Send a request to see the emulator's response.

Operations

7 of 7 operations in the vendored contract are emulated.

MethodPathOperationStatus
GET/AwsQuery
POST/AwsRpc
GET/{path}AwsRestGet
POST/{path}AwsRestPost
PUT/{path}AwsRestPut
PATCH/{path}AwsRestPatch
DELETE/{path}AwsRestDelete

Documentation

The package README, the same file that ships in the npm tarball.Edit on GitHub

Local emulators. Real API contracts. Part of Mockingbird.

Stateful local emulator of Amazon Identity and Access Management. ESM; Node 22+ or Bun 1.2+.

Usage

TypeScript
import { CreateUserCommand, IAMClient, ListUsersCommand } from "@aws-sdk/client-iam"
import { createServer } from "@crvouga/mockingbird-service-iam/server"

// Test setup: the IAM client your application already uses, pointed at the emulator.
const server = await createServer()
const iam = new IAMClient({
  endpoint: server.url,
  region: "us-east-1",
  credentials: { accessKeyId: "fixture", secretAccessKey: "fixture" },
})

// Application code, unchanged.
await iam.send(new CreateUserCommand({ UserName: "deploy-bot" }))
const { Users } = await iam.send(new ListUsersCommand({}))
// Users[0].Arn === "arn:aws:iam::000000000000:user/deploy-bot"

await server.close()

State lives in SQLite collections and participates in the shared runtime's namespace isolation, reset, timeline, clock, journal, metrics and fault controls. No AWS account is needed.

Implemented AWS operations: CreateUser, GetUser, ListUsers, DeleteUser, UpdateUser, CreateRole, GetRole, ListRoles, DeleteRole, UpdateAssumeRolePolicy, CreatePolicy, GetPolicy, ListPolicies, DeletePolicy, AttachRolePolicy, DetachRolePolicy, ListAttachedRolePolicies, AttachUserPolicy, DetachUserPolicy, ListAttachedUserPolicies, PutRolePolicy, GetRolePolicy, DeleteRolePolicy, ListRolePolicies, PutUserPolicy, GetUserPolicy, DeleteUserPolicy, ListUserPolicies, CreateAccessKey, ListAccessKeys, UpdateAccessKey, DeleteAccessKey, CreateGroup, GetGroup, ListGroups, DeleteGroup, AddUserToGroup, RemoveUserFromGroup, ListGroupsForUser, TagUser, UntagUser, ListUserTags, TagRole, UntagRole, ListRoleTags, GetAccountSummary.

Operations outside this list fail explicitly. This package emulates API state, not AWS infrastructure, production quotas, billing, IAM enforcement, or provider consoles. Service-specific omissions and oracle evidence are recorded in the AWS coverage ledger.

Run bun run parity with LocalStack on http://127.0.0.1:4566; an unavailable oracle fails the run. No LocalStack run is recorded for this integration. The parity command is a bounded read-only SDK envelope probe, not proof of full vendor equivalence.

Install

Shell
bun add @crvouga/mockingbird-service-iam

API

  • IamAPI(options?): low-level AWS transport instance with fetch and reset.

  • createRuntime(options?): in-process Fetch API and shared state controls.

  • createServer(options?) from the /server entry: HTTP listener with url, runtime, and close().

  • document, operationIds, and supportedOperationIds: generated transport contract metadata.

↑↓ to navigate↵ to open