second first commit

2026-09-22 08:57:00 -04:00
parent e88d7e2ff3
commit 0aef7fb2d8
4766 changed files with 1236986 additions and 0 deletions
@@ -0,0 +1,99 @@
+"""STS integration tests."""
+
+import pytest
+from botocore.exceptions import ClientError, ParamValidationError
+
+
+class TestSTSIdentity:
+    """Test STS identity operations."""
+
+    def test_get_caller_identity(self, sts_client):
+        """Test GetCallerIdentity returns identity details."""
+        response = sts_client.get_caller_identity()
+        assert response.get("Account")
+        assert response.get("Arn")
+        assert response.get("UserId")
+
+    def test_get_caller_identity_account_id(self, sts_client):
+        """Test GetCallerIdentity returns expected account ID."""
+        response = sts_client.get_caller_identity()
+        assert response["Account"] == "000000000000"
+
+
+class TestSTSAssumeRole:
+    """Test STS assume role operations."""
+
+    def test_assume_role(self, sts_client):
+        """Test AssumeRole returns temporary credentials."""
+        response = sts_client.assume_role(
+            RoleArn="arn:aws:iam::000000000000:role/pytest-assumed-role",
+            RoleSessionName="pytest-session",
+            DurationSeconds=3600,
+        )
+        creds = response["Credentials"]
+        assert creds["AccessKeyId"].startswith("ASIA")
+        assert creds["SecretAccessKey"]
+        assert creds["SessionToken"]
+
+    def test_assume_role_assumed_role_user(self, sts_client):
+        """Test AssumeRole returns AssumedRoleUser with correct ARN."""
+        response = sts_client.assume_role(
+            RoleArn="arn:aws:iam::000000000000:role/my-role",
+            RoleSessionName="my-session",
+        )
+        assert "assumed-role/my-role/my-session" in response["AssumedRoleUser"]["Arn"]
+
+    def test_assume_role_with_web_identity(self, sts_client):
+        """Test AssumeRoleWithWebIdentity returns credentials."""
+        response = sts_client.assume_role_with_web_identity(
+            RoleArn="arn:aws:iam::000000000000:role/web-identity-role",
+            RoleSessionName="web-session",
+            WebIdentityToken="dummy-token",
+            DurationSeconds=3600,
+        )
+        creds = response["Credentials"]
+        assert creds["AccessKeyId"].startswith("ASIA")
+        assert (
+            "assumed-role/web-identity-role/web-session"
+            in response["AssumedRoleUser"]["Arn"]
+        )
+
+    def test_assume_role_missing_role_arn(self, sts_client):
+        """Test AssumeRole validates required RoleArn parameter."""
+        with pytest.raises((ClientError, ParamValidationError)):
+            sts_client.assume_role(RoleSessionName="s")
+
+
+class TestSTSSessionToken:
+    """Test STS session token operations."""
+
+    def test_get_session_token(self, sts_client):
+        """Test GetSessionToken returns temporary credentials."""
+        response = sts_client.get_session_token(DurationSeconds=7200)
+        creds = response["Credentials"]
+        assert creds["AccessKeyId"].startswith("ASIA")
+        assert creds["SessionToken"]
+
+
+class TestSTSFederation:
+    """Test STS federation operations."""
+
+    def test_get_federation_token(self, sts_client):
+        """Test GetFederationToken returns credentials with federated user."""
+        response = sts_client.get_federation_token(
+            Name="pytest-fed-user", DurationSeconds=3600
+        )
+        creds = response["Credentials"]
+        assert creds["AccessKeyId"].startswith("ASIA")
+        assert "federated-user/pytest-fed-user" in response["FederatedUser"]["Arn"]
+
+
+class TestSTSUtilities:
+    """Test STS utility operations."""
+
+    def test_decode_authorization_message(self, sts_client):
+        """Test DecodeAuthorizationMessage decodes message."""
+        response = sts_client.decode_authorization_message(
+            EncodedMessage="test-encoded-message"
+        )
+        assert response.get("DecodedMessage")