mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-01 13:39:37 +08:00
Marco André Dinis
6286488be3
When the AWS Account ID is provided, we must check that it is a valid one. AWS Account ID is a well documented field: 12-digit string This check is meant to prevent typos when creating Databases mainly from the Web UI in the context of Teleport Discover.
101 lines
2.9 KiB
Go
101 lines
2.9 KiB
Go
/*
|
|
Copyright 2021 Gravitational, Inc.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package aws
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"github.com/aws/aws-sdk-go/aws"
|
|
"github.com/aws/aws-sdk-go/aws/request"
|
|
"github.com/aws/aws-sdk-go/service/sts"
|
|
"github.com/aws/aws-sdk-go/service/sts/stsiface"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// TestGetIdentity verifies parsing of AWS identity received from STS API.
|
|
func TestGetIdentity(t *testing.T) {
|
|
tests := []struct {
|
|
description string
|
|
inARN string
|
|
outIdentity Identity
|
|
outName string
|
|
outAccountID string
|
|
outPartition string
|
|
outType string
|
|
}{
|
|
{
|
|
description: "role identity",
|
|
inARN: "arn:aws:iam::123456789012:role/custom/path/EC2ReadOnly",
|
|
outIdentity: Role{},
|
|
outName: "EC2ReadOnly",
|
|
outAccountID: "123456789012",
|
|
outPartition: "aws",
|
|
outType: "role",
|
|
},
|
|
{
|
|
description: "assumed role identity",
|
|
inARN: "arn:aws:sts::123456789012:assumed-role/DatabaseAccess/i-1234567890",
|
|
outIdentity: Role{},
|
|
outName: "DatabaseAccess",
|
|
outAccountID: "123456789012",
|
|
outPartition: "aws",
|
|
outType: "assumed-role",
|
|
},
|
|
{
|
|
description: "user identity",
|
|
inARN: "arn:aws-us-gov:iam::123456789012:user/custom/path/alice",
|
|
outIdentity: User{},
|
|
outName: "alice",
|
|
outAccountID: "123456789012",
|
|
outPartition: "aws-us-gov",
|
|
outType: "user",
|
|
},
|
|
{
|
|
description: "unsupported identity",
|
|
inARN: "arn:aws:iam::123456789012:group/readers",
|
|
outIdentity: Unknown{},
|
|
outName: "readers",
|
|
outAccountID: "123456789012",
|
|
outPartition: "aws",
|
|
outType: "group",
|
|
},
|
|
}
|
|
for _, test := range tests {
|
|
t.Run(test.description, func(t *testing.T) {
|
|
identity, err := GetIdentityWithClient(context.Background(), &stsMock{arn: test.inARN})
|
|
require.NoError(t, err)
|
|
require.IsType(t, test.outIdentity, identity)
|
|
require.Equal(t, test.outName, identity.GetName())
|
|
require.Equal(t, test.outAccountID, identity.GetAccountID())
|
|
require.Equal(t, test.outPartition, identity.GetPartition())
|
|
require.Equal(t, test.outType, identity.GetType())
|
|
})
|
|
}
|
|
}
|
|
|
|
type stsMock struct {
|
|
stsiface.STSAPI
|
|
arn string
|
|
}
|
|
|
|
func (m *stsMock) GetCallerIdentityWithContext(aws.Context, *sts.GetCallerIdentityInput, ...request.Option) (*sts.GetCallerIdentityOutput, error) {
|
|
return &sts.GetCallerIdentityOutput{
|
|
Arn: aws.String(m.arn),
|
|
}, nil
|
|
}
|