catalin/moto
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Adding support for specifying a PermissionsBoundary ARN in calls to i… (#2182)

Browse source 
* Adding support for specifying a PermissionsBoundary ARN in calls to iam.create_role

Closes #2181

* Correcting whitespace error

* Adding support for Role PermissionsBoundary to be returned from
calls to list_roles

* Raise ClientError when a bad permissions boundary ARN is supplied
This commit is contained in:
Travis Truman 2019-05-21 12:44:06 -04:00 • committed by Terry Cain
commit b8ba7980a0
3 changed files with 45 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

21
tests/test_iam/test_iam.py
View file

@ -128,7 +128,6 @@ def test_create_role_and_instance_profile():
profile = conn.create_instance_profile('my-other-profile')
profile.path.should.equal('/')
@mock_iam_deprecated()
def test_remove_role_from_instance_profile():
conn = boto.connect_iam()
@ -358,7 +357,7 @@ def test_list_policy_versions():
versions = conn.list_policy_versions(
PolicyArn="arn:aws:iam::123456789012:policy/TestListPolicyVersions")
versions.get('Versions')[0].get('VersionId').should.equal('v1')
conn.create_policy_version(
PolicyArn="arn:aws:iam::123456789012:policy/TestListPolicyVersions",
PolicyDocument='{"second":"policy"}')
@ -1292,4 +1291,22 @@ def test_create_role_no_path():
conn = boto3.client('iam', region_name='us-east-1')
resp = conn.create_role(RoleName='my-role', AssumeRolePolicyDocument='some policy', Description='test')
resp.get('Role').get('Arn').should.equal('arn:aws:iam::123456789012:role/my-role')
resp.get('Role').should_not.have.key('PermissionsBoundary')
@mock_iam()
def test_create_role_with_permissions_boundary():
conn = boto3.client('iam', region_name='us-east-1')
boundary = 'arn:aws:iam::123456789012:policy/boundary'
resp = conn.create_role(RoleName='my-role', AssumeRolePolicyDocument='some policy', Description='test', PermissionsBoundary=boundary)
expected = {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': boundary
}
resp.get('Role').get('PermissionsBoundary').should.equal(expected)
invalid_boundary_arn = 'arn:aws:iam::123456789:not_a_boundary'
with assert_raises(ClientError):
conn.create_role(RoleName='bad-boundary', AssumeRolePolicyDocument='some policy', Description='test', PermissionsBoundary=invalid_boundary_arn)
# Ensure the PermissionsBoundary is included in role listing as well
conn.list_roles().get('Roles')[0].get('PermissionsBoundary').should.equal(expected)