Zakaria
100 lines
3.7 KiB
Python
100 lines
3.7 KiB
Python
"""STS integration tests."""
|
|
|
|
import pytest
|
|
from botocore.exceptions import ClientError, ParamValidationError
|
|
|
|
|
|
class TestSTSIdentity:
|
|
"""Test STS identity operations."""
|
|
|
|
def test_get_caller_identity(self, sts_client):
|
|
"""Test GetCallerIdentity returns identity details."""
|
|
response = sts_client.get_caller_identity()
|
|
assert response.get("Account")
|
|
assert response.get("Arn")
|
|
assert response.get("UserId")
|
|
|
|
def test_get_caller_identity_account_id(self, sts_client):
|
|
"""Test GetCallerIdentity returns expected account ID."""
|
|
response = sts_client.get_caller_identity()
|
|
assert response["Account"] == "000000000000"
|
|
|
|
|
|
class TestSTSAssumeRole:
|
|
"""Test STS assume role operations."""
|
|
|
|
def test_assume_role(self, sts_client):
|
|
"""Test AssumeRole returns temporary credentials."""
|
|
response = sts_client.assume_role(
|
|
RoleArn="arn:aws:iam::000000000000:role/pytest-assumed-role",
|
|
RoleSessionName="pytest-session",
|
|
DurationSeconds=3600,
|
|
)
|
|
creds = response["Credentials"]
|
|
assert creds["AccessKeyId"].startswith("ASIA")
|
|
assert creds["SecretAccessKey"]
|
|
assert creds["SessionToken"]
|
|
|
|
def test_assume_role_assumed_role_user(self, sts_client):
|
|
"""Test AssumeRole returns AssumedRoleUser with correct ARN."""
|
|
response = sts_client.assume_role(
|
|
RoleArn="arn:aws:iam::000000000000:role/my-role",
|
|
RoleSessionName="my-session",
|
|
)
|
|
assert "assumed-role/my-role/my-session" in response["AssumedRoleUser"]["Arn"]
|
|
|
|
def test_assume_role_with_web_identity(self, sts_client):
|
|
"""Test AssumeRoleWithWebIdentity returns credentials."""
|
|
response = sts_client.assume_role_with_web_identity(
|
|
RoleArn="arn:aws:iam::000000000000:role/web-identity-role",
|
|
RoleSessionName="web-session",
|
|
WebIdentityToken="dummy-token",
|
|
DurationSeconds=3600,
|
|
)
|
|
creds = response["Credentials"]
|
|
assert creds["AccessKeyId"].startswith("ASIA")
|
|
assert (
|
|
"assumed-role/web-identity-role/web-session"
|
|
in response["AssumedRoleUser"]["Arn"]
|
|
)
|
|
|
|
def test_assume_role_missing_role_arn(self, sts_client):
|
|
"""Test AssumeRole validates required RoleArn parameter."""
|
|
with pytest.raises((ClientError, ParamValidationError)):
|
|
sts_client.assume_role(RoleSessionName="s")
|
|
|
|
|
|
class TestSTSSessionToken:
|
|
"""Test STS session token operations."""
|
|
|
|
def test_get_session_token(self, sts_client):
|
|
"""Test GetSessionToken returns temporary credentials."""
|
|
response = sts_client.get_session_token(DurationSeconds=7200)
|
|
creds = response["Credentials"]
|
|
assert creds["AccessKeyId"].startswith("ASIA")
|
|
assert creds["SessionToken"]
|
|
|
|
|
|
class TestSTSFederation:
|
|
"""Test STS federation operations."""
|
|
|
|
def test_get_federation_token(self, sts_client):
|
|
"""Test GetFederationToken returns credentials with federated user."""
|
|
response = sts_client.get_federation_token(
|
|
Name="pytest-fed-user", DurationSeconds=3600
|
|
)
|
|
creds = response["Credentials"]
|
|
assert creds["AccessKeyId"].startswith("ASIA")
|
|
assert "federated-user/pytest-fed-user" in response["FederatedUser"]["Arn"]
|
|
|
|
|
|
class TestSTSUtilities:
|
|
"""Test STS utility operations."""
|
|
|
|
def test_decode_authorization_message(self, sts_client):
|
|
"""Test DecodeAuthorizationMessage decodes message."""
|
|
response = sts_client.decode_authorization_message(
|
|
EncodedMessage="test-encoded-message"
|
|
)
|
|
assert response.get("DecodedMessage")
|