From 56f89a5dcf01078f63cc9a00de32c9fde8521bad Mon Sep 17 00:00:00 2001
From: Louis Ruch <louisruch@gmail.com>
Date: Thu, 14 May 2026 10:59:38 -0700
Subject: [PATCH] test(host): update e2e testing to support shared test enviro
 creds (#69)

---
 testing/e2e_host_test.go          | 24 +++++++++------
 testing/testdata/host/iam.tf      | 35 +++++++++++++---------
 testing/testdata/host/variable.tf | 49 +++++++++++++++++++++++++++++++
 testing/testdata/host/vpc_ec2.tf  | 36 +++++++----------------
 4 files changed, 96 insertions(+), 48 deletions(-)
 create mode 100644 testing/testdata/host/variable.tf

diff --git a/testing/e2e_host_test.go b/testing/e2e_host_test.go
index 9e8007e..c0056b9 100644
--- a/testing/e2e_host_test.go
+++ b/testing/e2e_host_test.go
@@ -22,8 +22,6 @@ import (
 
 const expectedEc2InstanceCount = 5
 
-var expectedTags = []string{"foo", "bar", "baz"}
-
 func TestHostPlugin(t *testing.T) {
 	region := os.Getenv("AWS_REGION")
 	if region == "" {
@@ -80,6 +78,14 @@ func TestHostPlugin(t *testing.T) {
 	require.NoError(err)
 	require.Len(ec2InstanceTags, expectedEc2InstanceCount)
 
+	rawExpectedTags, err := tf.GetOutputSlice("instance_tag_keys")
+	require.NoError(err)
+	require.Len(rawExpectedTags, 3)
+	expectedTags := make([]string, 0, len(rawExpectedTags))
+	for _, rawExpectedTag := range rawExpectedTags {
+		expectedTags = append(expectedTags, rawExpectedTag.(string))
+	}
+
 	// Start the workflow now. Set up the host catalog. Note that this
 	// will cause the state to go out of drift above in the sense that
 	// the access key ID/secret access key will no longer be valid. We
@@ -143,13 +149,13 @@ func TestHostPlugin(t *testing.T) {
 	}
 
 	cases := [][]string{
-		{"foo"},
-		{"bar"},
-		{"baz"},
-		{"foo", "bar"},
-		{"foo", "baz"},
-		{"bar", "baz"},
-		{"foo", "bar", "baz"},
+		{expectedTags[0]},
+		{expectedTags[1]},
+		{expectedTags[2]},
+		{expectedTags[0], expectedTags[1]},
+		{expectedTags[0], expectedTags[2]},
+		{expectedTags[1], expectedTags[2]},
+		{expectedTags[0], expectedTags[1], expectedTags[2]},
 	}
 
 	for _, tc := range cases {
diff --git a/testing/testdata/host/iam.tf b/testing/testdata/host/iam.tf
index bde7716..7d0ad9f 100644
--- a/testing/testdata/host/iam.tf
+++ b/testing/testdata/host/iam.tf
@@ -1,24 +1,20 @@
 # Copyright IBM Corp. 2021, 2026
 # SPDX-License-Identifier: MPL-2.0
 
-variable "iam_user_prefix" {
-  default = "boundary-plugin-host-aws-test-iam-user"
-}
-
-variable "iam_user_count" {
-  default = 6
-}
-
 resource "random_id" "aws_iam_user_name" {
   count       = var.iam_user_count
-  prefix      = "${var.iam_user_prefix}-${count.index}"
+  prefix      = "demo-${local.hashicorp_email}-boundary-iam-user"
   byte_length = 4
 }
 
 resource "aws_iam_user" "user" {
-  count         = var.iam_user_count
-  name          = random_id.aws_iam_user_name[count.index].dec
-  force_destroy = true
+  count                = var.iam_user_count
+  name                 = random_id.aws_iam_user_name[count.index].dec
+  force_destroy        = true
+  permissions_boundary = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/DemoUser"
+  tags = {
+    "boundary-demo" = local.hashicorp_email
+  }
 }
 
 resource "aws_iam_access_key" "user_initial_key" {
@@ -26,8 +22,13 @@ resource "aws_iam_access_key" "user_initial_key" {
   user  = aws_iam_user.user[count.index].name
 }
 
+resource "random_id" "aws_ec2_policy_name" {
+  prefix      = "BoundaryPluginHost"
+  byte_length = 4
+}
+
 resource "aws_iam_policy" "ec2_describeinstances" {
-  name = "BoundaryPluginHostAwsTestDescribeInstancesPolicy"
+  name = random_id.aws_ec2_policy_name.dec
 
   policy = <<EOF
 {
@@ -51,9 +52,15 @@ resource "aws_iam_user_policy_attachment" "user_ec2_describeinstances_attachment
   policy_arn = aws_iam_policy.ec2_describeinstances.arn
 }
 
+resource "random_id" "aws_iam_policy_name" {
+  count       = var.iam_user_count
+  prefix      = "BoundaryPluginCredentials"
+  byte_length = 4
+}
+
 resource "aws_iam_policy" "user_self_manage_policy" {
   count = var.iam_user_count
-  name  = "BoundaryPluginHostAwsTestUserSelfManagePolicy-${count.index}"
+  name  = random_id.aws_iam_policy_name[count.index].dec
 
   policy = <<EOF
 {
diff --git a/testing/testdata/host/variable.tf b/testing/testdata/host/variable.tf
new file mode 100644
index 0000000..6ac1c6c
--- /dev/null
+++ b/testing/testdata/host/variable.tf
@@ -0,0 +1,49 @@
+# Copyright IBM Corp. 2021, 2026
+# SPDX-License-Identifier: MPL-2.0
+
+data "aws_caller_identity" "current" {}
+
+variable "iam_user_count" {
+  default = 6
+}
+
+# We are using a shared account for testing so make sure the stale ec2
+# machine tags don't match for this test run
+resource "random_id" "foo_key" {
+  prefix      = "foo"
+  byte_length = 4
+}
+
+resource "random_id" "bar_key" {
+  prefix      = "bar"
+  byte_length = 4
+}
+
+resource "random_id" "baz_key" {
+  prefix      = "baz"
+  byte_length = 4
+}
+
+locals {
+  hashicorp_email = split(":", data.aws_caller_identity.current.user_id)[1]
+  
+  instance_tags = [
+    {
+      "${random_id.foo_key.dec}" = "true"
+    },
+    {
+      "${random_id.foo_key.dec}" = "true"
+      "${random_id.bar_key.dec}" = "true"
+    },
+    {
+      "${random_id.bar_key.dec}" = "true"
+    },
+    {
+      "${random_id.bar_key.dec}" = "true"
+      "${random_id.baz_key.dec}" = "true"
+    },
+    {
+      "${random_id.baz_key.dec}" = "true"
+    },
+  ]
+}
diff --git a/testing/testdata/host/vpc_ec2.tf b/testing/testdata/host/vpc_ec2.tf
index cf97b05..23d0e55 100644
--- a/testing/testdata/host/vpc_ec2.tf
+++ b/testing/testdata/host/vpc_ec2.tf
@@ -1,28 +1,6 @@
 # Copyright IBM Corp. 2021, 2026
 # SPDX-License-Identifier: MPL-2.0
 
-variable "instance_tags" {
-  default = [
-    {
-      "foo" = "true",
-    },
-    {
-      "foo" = "true",
-      "bar" = "true",
-    },
-    {
-      "bar" = "true",
-    },
-    {
-      "bar" = "true",
-      "baz" = "true",
-    },
-    {
-      "baz" = "true",
-    },
-  ]
-}
-
 data "aws_availability_zones" "azs" {}
 
 data "aws_ami" "ubuntu" {
@@ -52,12 +30,12 @@ resource "aws_subnet" "subnet" {
 }
 
 resource "aws_instance" "instances" {
-  count         = length(var.instance_tags)
+  count         = length(local.instance_tags)
   ami           = data.aws_ami.ubuntu.id
   instance_type = "t3.nano"
   subnet_id     = aws_subnet.subnet.id
 
-  tags = var.instance_tags[count.index]
+  tags = local.instance_tags[count.index]
 }
 
 output "instance_ids" {
@@ -74,4 +52,12 @@ output "instance_tags" {
   value = {
     for _, r in aws_instance.instances : r.id => r.tags
   }
-}
\ No newline at end of file
+}
+
+output "instance_tag_keys" {
+  value = [
+    random_id.foo_key.dec,
+    random_id.bar_key.dec,
+    random_id.baz_key.dec,
+  ]
+}