second first commit

2026-09-22 08:57:00 -04:00
parent e88d7e2ff3
commit 0aef7fb2d8
4766 changed files with 1236986 additions and 0 deletions
@@ -0,0 +1,258 @@
+#!/usr/bin/env bats
+# IAM tests
+
+setup() {
+    load 'test_helper/common-setup'
+    ROLE_NAME="bats-test-role-$(unique_name)"
+    POLICY_ARN=""
+    ACCOUNT_ALIAS=""
+}
+
+teardown() {
+    if [ -n "$POLICY_ARN" ]; then
+        aws_cmd iam detach-role-policy --role-name "$ROLE_NAME" --policy-arn "$POLICY_ARN" >/dev/null 2>&1 || true
+        aws_cmd iam delete-policy --policy-arn "$POLICY_ARN" >/dev/null 2>&1 || true
+    fi
+    aws_cmd iam delete-role --role-name "$ROLE_NAME" >/dev/null 2>&1 || true
+    # An account holds one alias, so a leaked one would fail every later create.
+    if [ -n "$ACCOUNT_ALIAS" ]; then
+        aws_cmd iam delete-account-alias --account-alias "$ACCOUNT_ALIAS" >/dev/null 2>&1 || true
+    fi
+}
+
+@test "IAM: create role" {
+    local policy_doc='{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"lambda.amazonaws.com"},"Action":"sts:AssumeRole"}]}'
+
+    run aws_cmd iam create-role \
+        --role-name "$ROLE_NAME" \
+        --assume-role-policy-document "$policy_doc"
+    assert_success
+    arn=$(json_get "$output" '.Role.Arn')
+    [ -n "$arn" ]
+}
+
+@test "IAM: get role" {
+    local policy_doc='{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"lambda.amazonaws.com"},"Action":"sts:AssumeRole"}]}'
+    aws_cmd iam create-role --role-name "$ROLE_NAME" --assume-role-policy-document "$policy_doc" >/dev/null
+
+    run aws_cmd iam get-role --role-name "$ROLE_NAME"
+    assert_success
+    name=$(json_get "$output" '.Role.RoleName')
+    [ "$name" = "$ROLE_NAME" ]
+}
+
+@test "IAM: list roles" {
+    local policy_doc='{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"lambda.amazonaws.com"},"Action":"sts:AssumeRole"}]}'
+    aws_cmd iam create-role --role-name "$ROLE_NAME" --assume-role-policy-document "$policy_doc" >/dev/null
+
+    run aws_cmd iam list-roles
+    assert_success
+    found=$(echo "$output" | jq --arg name "$ROLE_NAME" '.Roles | any(.RoleName == $name)')
+    [ "$found" = "true" ]
+}
+
+@test "IAM: create and delete policy" {
+    local policy_doc='{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"*"}]}'
+
+    run aws_cmd iam create-policy \
+        --policy-name "bats-test-policy-$(unique_name)" \
+        --policy-document "$policy_doc"
+    assert_success
+    POLICY_ARN=$(json_get "$output" '.Policy.Arn')
+    [ -n "$POLICY_ARN" ]
+
+    run aws_cmd iam delete-policy --policy-arn "$POLICY_ARN"
+    assert_success
+    POLICY_ARN=""
+}
+
+@test "IAM: attach and detach role policy" {
+    local role_policy_doc='{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"lambda.amazonaws.com"},"Action":"sts:AssumeRole"}]}'
+    local policy_doc='{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"*"}]}'
+
+    aws_cmd iam create-role --role-name "$ROLE_NAME" --assume-role-policy-document "$role_policy_doc" >/dev/null
+
+    out=$(aws_cmd iam create-policy --policy-name "bats-test-policy-$(unique_name)" --policy-document "$policy_doc")
+    POLICY_ARN=$(json_get "$out" '.Policy.Arn')
+
+    run aws_cmd iam attach-role-policy --role-name "$ROLE_NAME" --policy-arn "$POLICY_ARN"
+    assert_success
+
+    run aws_cmd iam detach-role-policy --role-name "$ROLE_NAME" --policy-arn "$POLICY_ARN"
+    assert_success
+}
+
+@test "IAM: delete role" {
+    local policy_doc='{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"lambda.amazonaws.com"},"Action":"sts:AssumeRole"}]}'
+    aws_cmd iam create-role --role-name "$ROLE_NAME" --assume-role-policy-document "$policy_doc" >/dev/null
+
+    run aws_cmd iam delete-role --role-name "$ROLE_NAME"
+    assert_success
+}
+
+# ─── OIDC identity providers ────────────────────────────────────────────────
+
+# Creates a provider and sets OIDC_ARN. Each test uses a unique URL so the suite
+# stays safe when bats runs test files in parallel.
+create_oidc_provider() {
+    local url="https://oidc.bats.example.com/id/$(date +%s)-$$-${1:-0}"
+    local out
+    out=$(aws_cmd iam create-open-id-connect-provider \
+        --url "$url" \
+        --client-id-list sts.amazonaws.com \
+        --thumbprint-list 9e99a48a9960b14926bb7f3b02e22da2b0ab7280)
+    OIDC_ARN=$(json_get "$out" '.OpenIDConnectProviderArn')
+    OIDC_HOST="${url#https://}"
+}
+
+@test "IAM: create and get OIDC provider" {
+    create_oidc_provider 1
+    [ -n "$OIDC_ARN" ]
+
+    run aws_cmd iam get-open-id-connect-provider --open-id-connect-provider-arn "$OIDC_ARN"
+    assert_success
+    # AWS reports the URL without its scheme.
+    url=$(json_get "$output" '.Url')
+    [ "$url" = "$OIDC_HOST" ]
+    client=$(json_get "$output" '.ClientIDList[0]')
+    [ "$client" = "sts.amazonaws.com" ]
+
+    aws_cmd iam delete-open-id-connect-provider --open-id-connect-provider-arn "$OIDC_ARN" >/dev/null
+}
+
+@test "IAM: list OIDC providers includes the created provider" {
+    create_oidc_provider 2
+
+    run aws_cmd iam list-open-id-connect-providers
+    assert_success
+    found=$(echo "$output" | jq --arg arn "$OIDC_ARN" '.OpenIDConnectProviderList | any(.Arn == $arn)')
+    [ "$found" = "true" ]
+
+    aws_cmd iam delete-open-id-connect-provider --open-id-connect-provider-arn "$OIDC_ARN" >/dev/null
+}
+
+@test "IAM: add and remove an OIDC client id" {
+    create_oidc_provider 3
+
+    run aws_cmd iam add-client-id-to-open-id-connect-provider \
+        --open-id-connect-provider-arn "$OIDC_ARN" --client-id extra.audience
+    assert_success
+
+    run aws_cmd iam get-open-id-connect-provider --open-id-connect-provider-arn "$OIDC_ARN"
+    assert_success
+    count=$(json_get "$output" '.ClientIDList | length')
+    [ "$count" = "2" ]
+
+    run aws_cmd iam remove-client-id-from-open-id-connect-provider \
+        --open-id-connect-provider-arn "$OIDC_ARN" --client-id extra.audience
+    assert_success
+
+    aws_cmd iam delete-open-id-connect-provider --open-id-connect-provider-arn "$OIDC_ARN" >/dev/null
+}
+
+@test "IAM: update OIDC provider thumbprint" {
+    create_oidc_provider 4
+
+    run aws_cmd iam update-open-id-connect-provider-thumbprint \
+        --open-id-connect-provider-arn "$OIDC_ARN" \
+        --thumbprint-list 1111111111111111111111111111111111111111
+    assert_success
+
+    run aws_cmd iam get-open-id-connect-provider --open-id-connect-provider-arn "$OIDC_ARN"
+    assert_success
+    thumb=$(json_get "$output" '.ThumbprintList[0]')
+    [ "$thumb" = "1111111111111111111111111111111111111111" ]
+
+    aws_cmd iam delete-open-id-connect-provider --open-id-connect-provider-arn "$OIDC_ARN" >/dev/null
+}
+
+@test "IAM: delete OIDC provider" {
+    create_oidc_provider 5
+
+    run aws_cmd iam delete-open-id-connect-provider --open-id-connect-provider-arn "$OIDC_ARN"
+    assert_success
+
+    run aws_cmd iam get-open-id-connect-provider --open-id-connect-provider-arn "$OIDC_ARN"
+    assert_failure
+    assert_output --partial "NoSuchEntity"
+}
+
+@test "IAM: OIDC provider url must be https" {
+    run aws_cmd iam create-open-id-connect-provider \
+        --url http://oidc.bats.example.com/id/insecure \
+        --thumbprint-list 9e99a48a9960b14926bb7f3b02e22da2b0ab7280
+    assert_failure
+    assert_output --partial "ValidationError"
+}
+
+@test "IAM: list account aliases is empty by default" {
+    run aws_cmd iam list-account-aliases
+    assert_success
+    count=$(json_get "$output" '.AccountAliases | length')
+    [ "$count" = "0" ]
+}
+
+@test "IAM: create and list account alias" {
+    ACCOUNT_ALIAS="$(unique_name bats-alias)"
+
+    run aws_cmd iam create-account-alias --account-alias "$ACCOUNT_ALIAS"
+    assert_success
+
+    run aws_cmd iam list-account-aliases
+    assert_success
+    alias=$(json_get "$output" '.AccountAliases[0]')
+    [ "$alias" = "$ACCOUNT_ALIAS" ]
+}
+
+@test "IAM: creating another account alias replaces the current one" {
+    ACCOUNT_ALIAS="$(unique_name bats-alias)"
+    aws_cmd iam create-account-alias --account-alias "$ACCOUNT_ALIAS" >/dev/null
+
+    local replacement
+    replacement="$(unique_name bats-alias-two)"
+    run aws_cmd iam create-account-alias --account-alias "$replacement"
+    assert_success
+    ACCOUNT_ALIAS="$replacement"
+
+    run aws_cmd iam list-account-aliases
+    assert_success
+    alias=$(json_get "$output" '.AccountAliases[0]')
+    [ "$alias" = "$replacement" ]
+}
+
+@test "IAM: re-creating the alias the account already holds fails" {
+    ACCOUNT_ALIAS="$(unique_name bats-alias)"
+    aws_cmd iam create-account-alias --account-alias "$ACCOUNT_ALIAS" >/dev/null
+
+    run aws_cmd iam create-account-alias --account-alias "$ACCOUNT_ALIAS"
+    assert_failure
+    assert_output --partial "EntityAlreadyExists"
+}
+
+@test "IAM: deleting a mismatched account alias fails" {
+    ACCOUNT_ALIAS="$(unique_name bats-alias)"
+    aws_cmd iam create-account-alias --account-alias "$ACCOUNT_ALIAS" >/dev/null
+
+    run aws_cmd iam delete-account-alias --account-alias "bats-alias-not-set-$$"
+    assert_failure
+    assert_output --partial "NoSuchEntity"
+}
+
+@test "IAM: delete account alias" {
+    ACCOUNT_ALIAS="$(unique_name bats-alias)"
+    aws_cmd iam create-account-alias --account-alias "$ACCOUNT_ALIAS" >/dev/null
+
+    run aws_cmd iam delete-account-alias --account-alias "$ACCOUNT_ALIAS"
+    assert_success
+
+    run aws_cmd iam list-account-aliases
+    assert_success
+    count=$(json_get "$output" '.AccountAliases | length')
+    [ "$count" = "0" ]
+}
+
+@test "IAM: malformed account alias is rejected" {
+    run aws_cmd iam create-account-alias --account-alias "Upper-Case"
+    assert_failure
+    assert_output --partial "ValidationError"
+}