2015-03-20 16:59:48 +00:00
|
|
|
package aws
|
|
|
|
|
|
|
|
import (
|
2015-04-19 05:13:12 +00:00
|
|
|
"bytes"
|
|
|
|
"encoding/json"
|
|
|
|
"fmt"
|
2015-03-20 16:59:48 +00:00
|
|
|
"log"
|
|
|
|
"os"
|
|
|
|
"testing"
|
|
|
|
"time"
|
|
|
|
|
2015-08-06 16:26:41 +00:00
|
|
|
"github.com/aws/aws-sdk-go/aws"
|
2015-08-06 16:37:08 +00:00
|
|
|
"github.com/aws/aws-sdk-go/aws/credentials"
|
2015-10-30 22:22:48 +00:00
|
|
|
"github.com/aws/aws-sdk-go/aws/session"
|
2015-08-06 16:26:41 +00:00
|
|
|
"github.com/aws/aws-sdk-go/service/ec2"
|
2015-10-22 18:37:12 +00:00
|
|
|
"github.com/hashicorp/go-cleanhttp"
|
2015-03-20 16:59:48 +00:00
|
|
|
"github.com/hashicorp/vault/logical"
|
|
|
|
logicaltest "github.com/hashicorp/vault/logical/testing"
|
|
|
|
"github.com/mitchellh/mapstructure"
|
|
|
|
)
|
|
|
|
|
2015-12-01 05:05:04 +00:00
|
|
|
func getBackend(t *testing.T) logical.Backend {
|
|
|
|
be, _ := Factory(logical.TestBackendConfig())
|
|
|
|
return be
|
|
|
|
}
|
|
|
|
|
2015-03-20 16:59:48 +00:00
|
|
|
func TestBackend_basic(t *testing.T) {
|
|
|
|
logicaltest.Test(t, logicaltest.TestCase{
|
|
|
|
PreCheck: func() { testAccPreCheck(t) },
|
2015-12-01 05:05:04 +00:00
|
|
|
Backend: getBackend(t),
|
2015-03-20 16:59:48 +00:00
|
|
|
Steps: []logicaltest.TestStep{
|
|
|
|
testAccStepConfig(t),
|
|
|
|
testAccStepWritePolicy(t, "test", testPolicy),
|
|
|
|
testAccStepReadUser(t, "test"),
|
|
|
|
},
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
2016-01-08 22:19:53 +00:00
|
|
|
func TestBackend_basicSTS(t *testing.T) {
|
|
|
|
logicaltest.Test(t, logicaltest.TestCase{
|
|
|
|
PreCheck: func() { testAccPreCheck(t) },
|
|
|
|
Backend: getBackend(t),
|
|
|
|
Steps: []logicaltest.TestStep{
|
|
|
|
testAccStepConfig(t),
|
|
|
|
testAccStepWritePolicy(t, "test", testPolicy),
|
|
|
|
testAccStepReadSTS(t, "test"),
|
|
|
|
},
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
2015-04-19 05:13:12 +00:00
|
|
|
func TestBackend_policyCrud(t *testing.T) {
|
|
|
|
var compacted bytes.Buffer
|
|
|
|
if err := json.Compact(&compacted, []byte(testPolicy)); err != nil {
|
|
|
|
t.Fatalf("bad: %s", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
logicaltest.Test(t, logicaltest.TestCase{
|
2015-12-01 05:05:04 +00:00
|
|
|
Backend: getBackend(t),
|
2015-04-19 05:13:12 +00:00
|
|
|
Steps: []logicaltest.TestStep{
|
|
|
|
testAccStepConfig(t),
|
|
|
|
testAccStepWritePolicy(t, "test", testPolicy),
|
|
|
|
testAccStepReadPolicy(t, "test", compacted.String()),
|
|
|
|
testAccStepDeletePolicy(t, "test"),
|
|
|
|
testAccStepReadPolicy(t, "test", ""),
|
|
|
|
},
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
2015-03-20 16:59:48 +00:00
|
|
|
func testAccPreCheck(t *testing.T) {
|
|
|
|
if v := os.Getenv("AWS_ACCESS_KEY_ID"); v == "" {
|
|
|
|
t.Fatal("AWS_ACCESS_KEY_ID must be set for acceptance tests")
|
|
|
|
}
|
|
|
|
|
|
|
|
if v := os.Getenv("AWS_SECRET_ACCESS_KEY"); v == "" {
|
|
|
|
t.Fatal("AWS_SECRET_ACCESS_KEY must be set for acceptance tests")
|
|
|
|
}
|
|
|
|
|
|
|
|
if v := os.Getenv("AWS_DEFAULT_REGION"); v == "" {
|
|
|
|
log.Println("[INFO] Test: Using us-west-2 as test region")
|
|
|
|
os.Setenv("AWS_DEFAULT_REGION", "us-west-2")
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func testAccStepConfig(t *testing.T) logicaltest.TestStep {
|
|
|
|
return logicaltest.TestStep{
|
2016-01-07 15:30:47 +00:00
|
|
|
Operation: logical.UpdateOperation,
|
2015-04-19 05:21:31 +00:00
|
|
|
Path: "config/root",
|
2015-03-20 16:59:48 +00:00
|
|
|
Data: map[string]interface{}{
|
|
|
|
"access_key": os.Getenv("AWS_ACCESS_KEY_ID"),
|
|
|
|
"secret_key": os.Getenv("AWS_SECRET_ACCESS_KEY"),
|
|
|
|
"region": os.Getenv("AWS_DEFAULT_REGION"),
|
|
|
|
},
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func testAccStepReadUser(t *testing.T, name string) logicaltest.TestStep {
|
|
|
|
return logicaltest.TestStep{
|
|
|
|
Operation: logical.ReadOperation,
|
2015-04-27 21:20:28 +00:00
|
|
|
Path: "creds/" + name,
|
2015-03-20 16:59:48 +00:00
|
|
|
Check: func(resp *logical.Response) error {
|
|
|
|
var d struct {
|
|
|
|
AccessKey string `mapstructure:"access_key"`
|
|
|
|
SecretKey string `mapstructure:"secret_key"`
|
|
|
|
}
|
|
|
|
if err := mapstructure.Decode(resp.Data, &d); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
log.Printf("[WARN] Generated credentials: %v", d)
|
|
|
|
|
|
|
|
// Sleep sometime because AWS is eventually consistent
|
|
|
|
log.Println("[WARN] Sleeping for 10 seconds waiting for AWS...")
|
|
|
|
time.Sleep(10 * time.Second)
|
|
|
|
|
|
|
|
// Build a client and verify that the credentials work
|
2015-08-06 16:37:08 +00:00
|
|
|
creds := credentials.NewStaticCredentials(d.AccessKey, d.SecretKey, "")
|
|
|
|
awsConfig := &aws.Config{
|
|
|
|
Credentials: creds,
|
|
|
|
Region: aws.String("us-east-1"),
|
2015-10-22 18:37:12 +00:00
|
|
|
HTTPClient: cleanhttp.DefaultClient(),
|
2015-08-06 16:37:08 +00:00
|
|
|
}
|
2015-10-30 22:22:48 +00:00
|
|
|
client := ec2.New(session.New(awsConfig))
|
2015-03-20 16:59:48 +00:00
|
|
|
|
|
|
|
log.Printf("[WARN] Verifying that the generated credentials work...")
|
2015-08-06 16:37:08 +00:00
|
|
|
_, err := client.DescribeInstances(&ec2.DescribeInstancesInput{})
|
2015-03-20 16:59:48 +00:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
},
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-01-08 22:19:53 +00:00
|
|
|
func testAccStepReadSTS(t *testing.T, name string) logicaltest.TestStep {
|
|
|
|
return logicaltest.TestStep{
|
|
|
|
Operation: logical.ReadOperation,
|
|
|
|
Path: "sts/" + name,
|
|
|
|
Check: func(resp *logical.Response) error {
|
|
|
|
var d struct {
|
|
|
|
AccessKey string `mapstructure:"access_key"`
|
|
|
|
SecretKey string `mapstructure:"secret_key"`
|
|
|
|
STSToken string `mapstructure:"security_token"`
|
|
|
|
}
|
|
|
|
if err := mapstructure.Decode(resp.Data, &d); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
log.Printf("[WARN] Generated credentials: %v", d)
|
|
|
|
|
|
|
|
// Build a client and verify that the credentials work
|
|
|
|
creds := credentials.NewStaticCredentials(d.AccessKey, d.SecretKey, d.STSToken)
|
|
|
|
awsConfig := &aws.Config{
|
|
|
|
Credentials: creds,
|
|
|
|
Region: aws.String("us-east-1"),
|
|
|
|
HTTPClient: cleanhttp.DefaultClient(),
|
|
|
|
}
|
|
|
|
client := ec2.New(session.New(awsConfig))
|
|
|
|
|
|
|
|
log.Printf("[WARN] Verifying that the generated credentials work...")
|
|
|
|
_, err := client.DescribeInstances(&ec2.DescribeInstancesInput{})
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
},
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2015-03-20 16:59:48 +00:00
|
|
|
func testAccStepWritePolicy(t *testing.T, name string, policy string) logicaltest.TestStep {
|
|
|
|
return logicaltest.TestStep{
|
2016-01-07 15:30:47 +00:00
|
|
|
Operation: logical.UpdateOperation,
|
2015-04-27 21:20:28 +00:00
|
|
|
Path: "roles/" + name,
|
2015-03-20 16:59:48 +00:00
|
|
|
Data: map[string]interface{}{
|
2015-04-01 00:26:41 +00:00
|
|
|
"policy": testPolicy,
|
2015-03-20 16:59:48 +00:00
|
|
|
},
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2015-04-19 05:13:12 +00:00
|
|
|
func testAccStepDeletePolicy(t *testing.T, n string) logicaltest.TestStep {
|
|
|
|
return logicaltest.TestStep{
|
|
|
|
Operation: logical.DeleteOperation,
|
2015-04-27 21:20:28 +00:00
|
|
|
Path: "roles/" + n,
|
2015-04-19 05:13:12 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func testAccStepReadPolicy(t *testing.T, name string, value string) logicaltest.TestStep {
|
|
|
|
return logicaltest.TestStep{
|
|
|
|
Operation: logical.ReadOperation,
|
2015-04-27 21:20:28 +00:00
|
|
|
Path: "roles/" + name,
|
2015-04-19 05:13:12 +00:00
|
|
|
Check: func(resp *logical.Response) error {
|
|
|
|
if resp == nil {
|
|
|
|
if value == "" {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
return fmt.Errorf("bad: %#v", resp)
|
|
|
|
}
|
|
|
|
|
|
|
|
var d struct {
|
|
|
|
Policy string `mapstructure:"policy"`
|
|
|
|
}
|
|
|
|
if err := mapstructure.Decode(resp.Data, &d); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
if d.Policy != value {
|
|
|
|
return fmt.Errorf("bad: %#v", resp)
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
},
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2015-03-20 16:59:48 +00:00
|
|
|
const testPolicy = `
|
|
|
|
{
|
|
|
|
"Version": "2012-10-17",
|
|
|
|
"Statement": [
|
|
|
|
{
|
|
|
|
"Sid": "Stmt1426528957000",
|
|
|
|
"Effect": "Allow",
|
|
|
|
"Action": [
|
|
|
|
"ec2:*"
|
|
|
|
],
|
|
|
|
"Resource": [
|
|
|
|
"*"
|
|
|
|
]
|
|
|
|
}
|
|
|
|
]
|
|
|
|
}
|
|
|
|
`
|
2015-12-30 18:05:54 +00:00
|
|
|
|
|
|
|
const testPolicyArn = "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess"
|
|
|
|
|
|
|
|
func testAccStepWriteArnPolicyRef(t *testing.T, name string, arn string) logicaltest.TestStep {
|
|
|
|
return logicaltest.TestStep{
|
2016-01-21 20:04:16 +00:00
|
|
|
Operation: logical.UpdateOperation,
|
2015-12-30 18:05:54 +00:00
|
|
|
Path: "roles/" + name,
|
|
|
|
Data: map[string]interface{}{
|
|
|
|
"arn": testPolicyArn,
|
|
|
|
},
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestBackend_basicPolicyArnRef(t *testing.T) {
|
|
|
|
logicaltest.Test(t, logicaltest.TestCase{
|
|
|
|
PreCheck: func() { testAccPreCheck(t) },
|
|
|
|
Backend: getBackend(t),
|
|
|
|
Steps: []logicaltest.TestStep{
|
|
|
|
testAccStepConfig(t),
|
|
|
|
testAccStepWriteArnPolicyRef(t, "test", testPolicyArn),
|
|
|
|
testAccStepReadUser(t, "test"),
|
|
|
|
},
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestBackend_policyArnCrud(t *testing.T) {
|
|
|
|
logicaltest.Test(t, logicaltest.TestCase{
|
|
|
|
Backend: getBackend(t),
|
|
|
|
Steps: []logicaltest.TestStep{
|
|
|
|
testAccStepConfig(t),
|
|
|
|
testAccStepWriteArnPolicyRef(t, "test", testPolicyArn),
|
|
|
|
testAccStepReadArnPolicy(t, "test", testPolicyArn),
|
|
|
|
testAccStepDeletePolicy(t, "test"),
|
|
|
|
testAccStepReadArnPolicy(t, "test", ""),
|
|
|
|
},
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
|
|
|
func testAccStepReadArnPolicy(t *testing.T, name string, value string) logicaltest.TestStep {
|
|
|
|
return logicaltest.TestStep{
|
|
|
|
Operation: logical.ReadOperation,
|
|
|
|
Path: "roles/" + name,
|
|
|
|
Check: func(resp *logical.Response) error {
|
|
|
|
if resp == nil {
|
|
|
|
if value == "" {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
return fmt.Errorf("bad: %#v", resp)
|
|
|
|
}
|
|
|
|
|
|
|
|
var d struct {
|
|
|
|
Policy string `mapstructure:"arn"`
|
|
|
|
}
|
|
|
|
if err := mapstructure.Decode(resp.Data, &d); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
if d.Policy != value {
|
|
|
|
return fmt.Errorf("bad: %#v", resp)
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
},
|
|
|
|
}
|
|
|
|
}
|