Damian Debkowski
07f015be28
* feat: assume role provider credentials This commit updates the awsutil dependency to its latest version, which supports the capability of using dynamic credentials. The storage service was refactored to make static credentials optional. The credentials pkg was refactored to support several attribute fields used for the assume role provider. The host service still enforces the use of static credentials.
88 lines
2.7 KiB
Go
88 lines
2.7 KiB
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: MPL-2.0
|
|
|
|
package credential
|
|
|
|
import (
|
|
"github.com/aws/aws-sdk-go/aws/session"
|
|
"github.com/aws/aws-sdk-go/service/iam"
|
|
"github.com/aws/aws-sdk-go/service/iam/iamiface"
|
|
"github.com/hashicorp/go-secure-stdlib/awsutil"
|
|
"google.golang.org/protobuf/types/known/structpb"
|
|
)
|
|
|
|
const (
|
|
testOptionErr = "test option error"
|
|
testGetCallerIdentityErr = "test error for GetCallerIdentity"
|
|
testGetUserErr = "test error for GetUser"
|
|
testDeleteAccessKeyErr = "test error for DeleteAccessKey"
|
|
)
|
|
|
|
type testMockIAMState struct {
|
|
DeleteAccessKeyCalled bool
|
|
}
|
|
|
|
func (s *testMockIAMState) Reset() {
|
|
s.DeleteAccessKeyCalled = false
|
|
}
|
|
|
|
type testMockIAM struct {
|
|
iamiface.IAMAPI
|
|
|
|
State *testMockIAMState
|
|
}
|
|
|
|
func (m *testMockIAM) DeleteAccessKey(input *iam.DeleteAccessKeyInput) (*iam.DeleteAccessKeyOutput, error) {
|
|
m.State.DeleteAccessKeyCalled = true
|
|
return m.IAMAPI.DeleteAccessKey(input)
|
|
}
|
|
|
|
func newTestMockIAM(state *testMockIAMState, opts ...awsutil.MockIAMOption) awsutil.IAMAPIFunc {
|
|
return func(sess *session.Session) (iamiface.IAMAPI, error) {
|
|
m := &testMockIAM{
|
|
State: state,
|
|
}
|
|
f := awsutil.NewMockIAM(opts...)
|
|
var err error
|
|
|
|
m.IAMAPI, err = f(sess)
|
|
return m, err
|
|
}
|
|
}
|
|
|
|
// MockStaticCredentialSecrets returns a *structpb.Struct that contains two
|
|
// key pair values: (access_key_id, AKIA_foobar) & (secret_access_key, bazqux)
|
|
func MockStaticCredentialSecrets() *structpb.Struct {
|
|
return &structpb.Struct{
|
|
Fields: map[string]*structpb.Value{
|
|
ConstAccessKeyId: structpb.NewStringValue("AKIA_foobar"),
|
|
ConstSecretAccessKey: structpb.NewStringValue("bazqux"),
|
|
},
|
|
}
|
|
}
|
|
|
|
// MockAssumeRoleAttributes returns a *structpb.Struct that contains six key pair values:
|
|
//
|
|
// (region, region)
|
|
// (disable_credential_rotation, disableRotate)
|
|
// (role_arn, arn:aws:iam::123456789012:role/S3Access)
|
|
// (role_external_id, 1234567890)
|
|
// (role_session_name, ec2-assume-role-provider)
|
|
// (role_tags, struct{foo:bar})
|
|
func MockAssumeRoleAttributes(region string, disableRotate bool) *structpb.Struct {
|
|
return &structpb.Struct{
|
|
Fields: map[string]*structpb.Value{
|
|
ConstRegion: structpb.NewStringValue(region),
|
|
ConstDisableCredentialRotation: structpb.NewBoolValue(disableRotate),
|
|
ConstRoleArn: structpb.NewStringValue("arn:aws:iam::123456789012:role/S3Access"),
|
|
ConstRoleExternalId: structpb.NewStringValue("1234567890"),
|
|
ConstRoleSessionName: structpb.NewStringValue("ec2-assume-role-provider"),
|
|
ConstRoleTags: structpb.NewStructValue(&structpb.Struct{
|
|
Fields: map[string]*structpb.Value{
|
|
"foo": structpb.NewStringValue("bar"),
|
|
},
|
|
}),
|
|
},
|
|
}
|
|
}
|