10000 set aws marker for all iam tests, fix the easy issues (#9153) · localstack/localstack@858bbf2 · GitHub
[go: up one dir, main page]
Skip to content

Commit 858bbf2

Browse files
dfangldfangl
authored
set aws marker for all iam tests, fix the easy issues (#9153)
1 parent 51e5d0b commit 858bbf2

File tree

3 files changed

+81
-60
lines changed

3 files changed

+81
-60
lines changed

‎localstack/testing/pytest/fixtures.py

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1342,7 +1342,14 @@ def _create_user(**kwargs):
13421342
yield _create_user
13431343

13441344
for username in usernames:
1345-
inline_policies = aws_client.iam.list_user_policies(UserName=username)["PolicyNames"]
1345+
try:
1346+
inline_policies = aws_client.iam.list_user_policies(UserName=username)["PolicyNames"]
1347+
except ClientError as e:
1348+
LOG.debug(
1349+
"Cannot list user policies: %s. User %s probably already deleted...", e, username
1350+
)
1351+
continue
1352+
13461353
for inline_policy in inline_policies:
13471354
try:
13481355
aws_client.iam.delete_user_policy(UserName=username, PolicyName=inline_policy)
@@ -1419,9 +1426,17 @@ def _create_role(iam_client=None, **kwargs):
14191426

14201427
for role_name, iam_client in role_names:
14211428
# detach policies
1422-
attached_policies = iam_client.list_attached_role_policies(RoleName=role_name)[
1423-
"AttachedPolicies"
1424-
]
1429+
try:
1430+
attached_policies = iam_client.list_attached_role_policies(RoleName=role_name)[
1431+
"AttachedPolicies"
1432+
]
1433+
except ClientError as e:
1434+
LOG.debug(
1435+
"Cannot list attached role policies: %s. Role %s probably already deleted...",
1436+
e,
1437+
role_name,
1438+
)
1439+
continue
14251440
for attached_policy in attached_policies:
14261441
try:
14271442
iam_client.detach_role_policy(

‎tests/aws/services/iam/test_iam.py

Lines changed: 56 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
import pytest
44
from botocore.exceptions import ClientError
55

6-
from localstack.aws.accounts import get_aws_account_id
76
from localstack.aws.api.iam import Tag
87
from localstack.services.iam.provider import ADDITIONAL_MANAGED_POLICIES
98
from localstack.testing.aws.util import create_client_with_keys, wait_for_user
@@ -25,7 +24,7 @@
2524

2625

2726
class TestIAMExtensions:
28-
@markers.aws.unknown
27+
@markers.aws.validated
2928
def test_get_user_without_username_as_user(self, create_user, aws_client):
3029
user_name = f"user-{short_uid()}"
3130
policy_name = f"policy={short_uid()}"
@@ -51,7 +50,7 @@ def test_get_user_without_username_as_root(self, aws_client):
5150
assert user["UserId"] == account_id
5251
assert user["Arn"] == f"arn:aws:iam::{account_id}:root"
5352

54-
@markers.aws.unknown
53+
@markers.aws.validated
5554
def test_get_user_without_username_as_role(self, create_role, wait_and_assume_role, aws_client):
5655
role_name = f"role-{short_uid()}"
5756
policy_name = f"policy={short_uid()}"
@@ -79,7 +78,7 @@ def test_get_user_without_username_as_role(self, create_role, wait_and_assume_ro
7978
iam_client_as_role.get_user()
8079
e.match("Must specify userName when calling with non-User credentials")
8180

82-
@markers.aws.unknown
81+
@markers.aws.validated
8382
def test_create_user_with_permission_boundary(self, create_user, create_policy, aws_client):
8483
user_name = f"user-{short_uid()}"
8584
policy_name = f"policy-{short_uid()}"
@@ -102,7 +101,7 @@ def test_create_user_with_permission_boundary(self, create_user, create_policy,
102101
get_user_reply = aws_client.iam.get_user(UserName=user_name)
103102
assert "PermissionsBoundary" not in get_user_reply["User"]
104103

105-
@markers.aws.unknown
104+
@markers.aws.validated
106105
def test_create_user_add_permission_boundary_afterwards(
107106
self, create_user, create_policy, aws_client
108107
):
@@ -152,8 +151,10 @@ def test_create_role_with_malformed_assume_role_policy_document(self, aws_client
152151

153152

154153
class TestIAMIntegrations:
155-
@markers.aws.unknown
156-
def test_attach_iam_role_to_new_iam_user(self, aws_client):
154+
@markers.aws.validated
155+
def test_attach_iam_role_to_new_iam_user(
156+
self, aws_client, account_id, create_user, create_policy
157+
):
157158
test_policy_document = {
158159
"Version": "2012-10-17",
159160
"Statement": {
@@ -162,14 +163,14 @@ def test_attach_iam_role_to_new_iam_user(self, aws_client):
162163
"Resource": "arn:aws:s3:::example_bucket",
163164
},
164165
}
165-
test_user_name = "test-user"
166+
test_user_name = f"test-user-{short_uid()}"
166167

167-
aws_client.iam.create_user(UserName=test_user_name)
168-
response = aws_client.iam.create_policy(
169-
PolicyName="test-policy", PolicyDocument=json.dumps(test_policy_document)
168+
create_user(UserName=test_user_name)
169+
response = create_policy(
170+
PolicyName=f"test-policy-{short_uid()}", PolicyDocument=json.dumps(test_policy_document)
170171
)
171172
test_policy_arn = response["Policy"]["Arn"]
172-
assert get_aws_account_id() in test_policy_arn
173+
assert account_id in test_policy_arn
173174

174175
aws_client.iam.attach_user_policy(UserName=test_user_name, PolicyArn=test_policy_arn)
175176
attached_user_policies = aws_client.iam.list_attached_user_policies(UserName=test_user_name)
@@ -187,7 +188,7 @@ def test_attach_iam_role_to_new_iam_user(self, aws_client):
187188
assert ctx.typename == "NoSuchEntityException"
188189
assert ctx.value.response["Error"]["Code"] == "NoSuchEntity"
189190

190-
@markers.aws.unknown
191+
@markers.aws.validated
191192
def test_delete_non_existent_policy_returns_no_such_entity(self, aws_client):
192193
non_existent_policy_arn = "arn:aws:iam::000000000000:policy/non-existent-policy"
193194

@@ -196,21 +197,22 @@ def test_delete_non_existent_policy_returns_no_such_entity(self, aws_client):
196197
assert ctx.typename == "NoSuchEntityException"
197198
assert ctx.value.response["Error"]["Code"] == "NoSuchEntity"
198199

199-
@markers.aws.unknown
200-
def test_recreate_iam_role(self, aws_client):
201-
role_name = "role-{}".format(short_uid())
200+
@markers.aws.validated
201+
def test_recreate_iam_role(self, aws_client, create_role):
202+
role_name = f"role-{short_uid()}"
202203

203204
assume_policy_document = {
204205
"Version": "2012-10-17",
205206
"Statement": [
206207
{
207208
"Action": "sts:AssumeRole",
208209
"Principal": {"Service": "lambda.amazonaws.com"},
210+
"Effect": "Allow",
209211
}
210212
],
211213
}
212214

213-
rs = aws_client.iam.create_role(
215+
rs = create_role(
214216
RoleName=role_name,
215217
AssumeRolePolicyDocument=json.dumps(assume_policy_document),
216218
)
@@ -227,43 +229,46 @@ def test_recreate_iam_role(self, aws_client):
227229
except ClientError as e:
228230
assert e.response["Error"]["Code"] == "EntityAlreadyExists"
229231

230-
# clean up
231-
aws_client.iam.delete_role(RoleName=role_name)
232-
233-
@markers.aws.unknown
234-
def test_instance_profile_tags(self, aws_client):
232+
@markers.aws.validated
233+
def test_instance_profile_tags(self, aws_client, cleanups):
235234
def gen_tag():
236235
return Tag(Key=f"key-{long_uid()}", Value=f"value-{short_uid()}")
237236

238-
user_name = "user-role-{}".format(short_uid())
237+
def _sort_key(entry):
238+
return entry["Key"]
239+
240+
user_name = f"user-role-{short_uid()}"
239241
aws_client.iam.create_instance_profile(InstanceProfileName=user_name)
242+
cleanups.append(
243+
lambda: aws_client.iam.delete_instance_profile(InstanceProfileName=user_name)
244+
)
240245

241246
tags_v0 = []
242247
#
243248
rs = aws_client.iam.list_instance_profile_tags(InstanceProfileName=user_name)
244-
assert rs["Tags"] == tags_v0
249+
assert rs["Tags"].sort(key=_sort_key) == tags_v0.sort(key=_sort_key)
245250

246251
tags_v1 = [gen_tag()]
247252
#
248253
rs = aws_client.iam.tag_instance_profile(InstanceProfileName=user_name, Tags=tags_v1)
249254
assert rs["ResponseMetadata"]["HTTPStatusCode"] == 200
250255
#
251256
rs = aws_client.iam.list_instance_profile_tags(InstanceProfileName=user_name)
252-
assert rs["Tags"] == tags_v1
257+
assert rs["Tags"].sort(key=_sort_key) == tags_v1.sort(key=_sort_key)
253258

254259
tags_v2_new = [gen_tag() for _ in range(5)]
255260
tags_v2 = tags_v1 + tags_v2_new
256261
rs = aws_client.iam.tag_instance_profile(InstanceProfileName=user_name, Tags=tags_v2)
257262
assert rs["ResponseMetadata"]["HTTPStatusCode"] == 200
258263
#
259264
rs = aws_client.iam.list_instance_profile_tags(InstanceProfileName=user_name)
260-
assert rs["Tags"] == tags_v2
265+
assert rs["Tags"].sort(key=_sort_key) == tags_v2.sort(key=_sort_key)
261266

262267
rs = aws_client.iam.tag_instance_profile(InstanceProfileName=user_name, Tags=tags_v2)
263268
assert rs["ResponseMetadata"]["HTTPStatusCode"] == 200
264269
#
265270
rs = aws_client.iam.list_instance_profile_tags(InstanceProfileName=user_name)
266-
assert rs["Tags"] == tags_v2
271+
assert rs["Tags"].sort(key=_sort_key) == tags_v2.sort(key=_sort_key)
267272

268273
tags_v3_new = [gen_tag()]
269274
tags_v3 = tags_v1 + tags_v3_new
@@ -272,42 +277,40 @@ def gen_tag():
272277
assert rs["ResponseMetadata"]["HTTPStatusCode"] == 200
273278
#
274279
rs = aws_client.iam.list_instance_profile_tags(InstanceProfileName=user_name)
275-
assert rs["Tags"] == target_tags_v3
280+
assert rs["Tags"].sort(key=_sort_key) == target_tags_v3.sort(key=_sort_key)
276281

277282
tags_v4 = tags_v1
278283
target_tags_v4 = target_tags_v3
279284
rs = aws_client.iam.tag_instance_profile(InstanceProfileName=user_name, Tags=tags_v4)
280285
assert rs["ResponseMetadata"]["HTTPStatusCode"] == 200
281286
#
282287
rs = aws_client.iam.list_instance_profile_tags(InstanceProfileName=user_name)
283-
assert rs["Tags"] == target_tags_v4
288+
assert rs["Tags"].sort(key=_sort_key) == target_tags_v4.sort(key=_sort_key)
284289

285290
tags_u_v1 = [tag["Key"] for tag in tags_v1]
286291
target_tags_u_v1 = tags_v2_new + tags_v3_new
287292
aws_client.iam.untag_instance_profile(InstanceProfileName=user_name, TagKeys=tags_u_v1)
288293
#
289294
rs = aws_client.iam.list_instance_profile_tags(InstanceProfileName=user_name)
290-
assert rs["Tags"] == target_tags_u_v1
295+
assert rs["Tags"].sort(key=_sort_key) == target_tags_u_v1.sort(key=_sort_key)
291296

292297
tags_u_v2 = [f"key-{long_uid()< F438 span class=pl-kos>}"]
293298
target_tags_u_v2 = target_tags_u_v1
294299
aws_client.iam.untag_instance_profile(InstanceProfileName=user_name, TagKeys=tags_u_v2)
295300
#
296301
rs = aws_client.iam.list_instance_profile_tags(InstanceProfileName=user_name)
297-
assert rs["Tags"] == target_tags_u_v2
302+
assert rs["Tags"].sort(key=_sort_key) == target_tags_u_v2.sort(key=_sort_key)
298303

299304
tags_u_v3 = [tag["Key"] for tag in target_tags_u_v1]
300305
target_tags_u_v3 = []
301306
aws_client.iam.untag_instance_profile(InstanceProfileName=user_name, TagKeys=tags_u_v3)
302307
#
303308
rs = aws_client.iam.list_instance_profile_tags(InstanceProfileName=user_name)
304-
assert rs["Tags"] == target_tags_u_v3
305-
306-
aws_client.iam.delete_instance_profile(InstanceProfileName=user_name)
309+
assert rs["Tags"].sort(key=_sort_key) == target_tags_u_v3.sort(key=_sort_key)
307310

308-
@markers.aws.unknown
311+
@markers.aws.validated
309312
def test_create_user_with_tags(self, aws_client):
310-
user_name = "user-role-{}".format(short_uid())
313+
user_name = f"user-role-{short_uid()}"
311314

312315
rs = aws_client.iam.create_user(
313316
UserName=user_name, Tags=[{"Key": "env", "Value": "production"}]
@@ -324,10 +327,10 @@ def test_create_user_with_tags(self, aws_client):
324327
# clean up
325328
aws_client.iam.delete_user(UserName=user_name)
326329

327-
@markers.aws.unknown
330+
@markers.aws.validated
328331
def test_attach_detach_role_policy(self, aws_client):
329-
role_name = "s3-role-{}".format(short_uid())
330-
policy_name = "s3-role-policy-{}".format(short_uid())
332+
role_name = f"s3-role-{short_uid()}"
333+
policy_name = f"s3-role-policy-{short_uid()}"
331334

332335
policy_arns = [p["Arn"] for p in ADDITIONAL_MANAGED_POLICIES.values()]
333336

@@ -337,6 +340,7 @@ def test_attach_detach_role_policy(self, aws_client):
337340
{
338341
"Action": "sts:AssumeRole",
339342
"Principal": {"Service": "s3.amazonaws.com"},
343+
"Effect": "Allow",
340344
}
341345
],
342346
}
@@ -389,8 +393,10 @@ def test_attach_detach_role_policy(self, aws_client):
389393

390394
aws_client.iam.delete_policy(PolicyArn=policy_arn)
391395

392-
@markers.aws.unknown
396+
@markers.aws.needs_fixing
393397
def test_simulate_principle_policy(self, aws_client):
398+
# FIXME this test should test whether a principal (like user, role) has some permissions, it cannot test
399+
# the policy itself
394400
policy_name = "policy-{}".format(short_uid())
395401
policy_document = {
396402
"Version": "2012-10-17",
@@ -422,8 +428,8 @@ def test_simulate_principle_policy(self, aws_client):
422428
assert "s3:GetObjectVersion" in actions
423429
assert actions["s3:GetObjectVersion"]["EvalDecision"] == "allowed"
424430

425-
@markers.aws.unknown
426-
def test_create_role_with_assume_role_policy(self, aws_client):
431+
@markers.aws.validated
432+
def test_create_role_with_assume_role_policy(self, aws_client, account_id, create_role):
427433
role_name_1 = f"role-{short_uid()}"
428434
role_name_2 = f"role-{short_uid()}"
429435

@@ -433,13 +439,13 @@ def test_create_role_with_assume_role_policy(self, aws_client):
433439
{
434440
"Action": "sts:AssumeRole",
435441
"Effect": "Allow",
436-
"Principal": {"AWS": ["arn:aws:iam::123412341234:root"]},
442+
"Principal": {"AWS": f"arn:aws:iam::{account_id}:root"},
437443
}
438444
],
439445
}
440446
str_assume_role_policy_doc = json.dumps(assume_role_policy_doc)
441447

442-
aws_client.iam.create_role(
448+
create_role(
443449
Path="/",
444450
RoleName=role_name_1,
445451
AssumeRolePolicyDocument=str_assume_role_policy_doc,
@@ -450,7 +456,7 @@ def test_create_role_with_assume_role_policy(self, aws_client):
450456
if role["RoleName"] == role_name_1:
451457
assert role["AssumeRolePolicyDocument"] == assume_role_policy_doc
452458

453-
aws_client.iam.create_role(
459+
create_role(
454460
Path="/",
455461
RoleName=role_name_2,
456462
AssumeRolePolicyDocument=str_assume_role_policy_doc,
@@ -463,17 +469,17 @@ def test_create_role_with_assume_role_policy(self, aws_client):
463469
assert role["AssumeRolePolicyDocument"] == assume_role_policy_doc
464470
aws_client.iam.delete_role(RoleName=role["RoleName"])
465471

466-
aws_client.iam.create_role(
467-
Path="myPath",
472+
create_role(
473+
Path="/myPath/",
468474
RoleName=role_name_2,
469475
AssumeRolePolicyDocument=str_assume_role_policy_doc,
470476
Description="string",
471477
)
472478

473-
roles = aws_client.iam.list_roles(PathPrefix="my")
474-
assert roles["Roles"][0]["Path"] == "myPath"
475-
assert roles["Roles"][0]["RoleName"] == role_name_2
479+
roles = aws_client.iam.list_roles(PathPrefix="/my")
476480
assert len(roles["Roles"]) == 1
481+
assert roles["Roles"][0]["Path"] == "/myPath/"
482+
assert roles["Roles"][0]["RoleName"] == role_name_2
477483

478484
@markers.aws.validated
479485
@pytest.mark.xfail

0 commit comments

Comments
 (0)
0