Merge remote-tracking branch 'upstream/master'
This commit is contained in:
Stephan Huber
parent
3020ee408a
commit
b94147a1d5
14 changed files with 4499 additions and 0 deletions
706
tests/test_core/test_auth.py
Normal file
706
tests/test_core/test_auth.py
Normal file
|
|
@ -0,0 +1,706 @@
|
|||
import json
|
||||
|
||||
import boto3
|
||||
import sure # noqa
|
||||
from botocore.exceptions import ClientError
|
||||
# Ensure 'assert_raises' context manager support for Python 2.6
|
||||
import tests.backport_assert_raises
|
||||
from nose.tools import assert_raises
|
||||
|
||||
from moto import mock_iam, mock_ec2, mock_s3, mock_sts, mock_elbv2, mock_rds2
|
||||
from moto.core import set_initial_no_auth_action_count
|
||||
from moto.iam.models import ACCOUNT_ID
|
||||
|
||||
|
||||
@mock_iam
|
||||
def create_user_with_access_key(user_name='test-user'):
|
||||
client = boto3.client('iam', region_name='us-east-1')
|
||||
client.create_user(UserName=user_name)
|
||||
return client.create_access_key(UserName=user_name)['AccessKey']
|
||||
|
||||
|
||||
@mock_iam
|
||||
def create_user_with_access_key_and_inline_policy(user_name, policy_document, policy_name='policy1'):
|
||||
client = boto3.client('iam', region_name='us-east-1')
|
||||
client.create_user(UserName=user_name)
|
||||
client.put_user_policy(UserName=user_name, PolicyName=policy_name, PolicyDocument=json.dumps(policy_document))
|
||||
return client.create_access_key(UserName=user_name)['AccessKey']
|
||||
|
||||
|
||||
@mock_iam
|
||||
def create_user_with_access_key_and_attached_policy(user_name, policy_document, policy_name='policy1'):
|
||||
client = boto3.client('iam', region_name='us-east-1')
|
||||
client.create_user(UserName=user_name)
|
||||
policy_arn = client.create_policy(
|
||||
PolicyName=policy_name,
|
||||
PolicyDocument=json.dumps(policy_document)
|
||||
)['Policy']['Arn']
|
||||
client.attach_user_policy(UserName=user_name, PolicyArn=policy_arn)
|
||||
return client.create_access_key(UserName=user_name)['AccessKey']
|
||||
|
||||
|
||||
@mock_iam
|
||||
def create_user_with_access_key_and_multiple_policies(user_name, inline_policy_document,
|
||||
attached_policy_document, inline_policy_name='policy1', attached_policy_name='policy1'):
|
||||
client = boto3.client('iam', region_name='us-east-1')
|
||||
client.create_user(UserName=user_name)
|
||||
policy_arn = client.create_policy(
|
||||
PolicyName=attached_policy_name,
|
||||
PolicyDocument=json.dumps(attached_policy_document)
|
||||
)['Policy']['Arn']
|
||||
client.attach_user_policy(UserName=user_name, PolicyArn=policy_arn)
|
||||
client.put_user_policy(UserName=user_name, PolicyName=inline_policy_name, PolicyDocument=json.dumps(inline_policy_document))
|
||||
return client.create_access_key(UserName=user_name)['AccessKey']
|
||||
|
||||
|
||||
def create_group_with_attached_policy_and_add_user(user_name, policy_document,
|
||||
group_name='test-group', policy_name='policy1'):
|
||||
client = boto3.client('iam', region_name='us-east-1')
|
||||
client.create_group(GroupName=group_name)
|
||||
policy_arn = client.create_policy(
|
||||
PolicyName=policy_name,
|
||||
PolicyDocument=json.dumps(policy_document)
|
||||
)['Policy']['Arn']
|
||||
client.attach_group_policy(GroupName=group_name, PolicyArn=policy_arn)
|
||||
client.add_user_to_group(GroupName=group_name, UserName=user_name)
|
||||
|
||||
|
||||
def create_group_with_inline_policy_and_add_user(user_name, policy_document,
|
||||
group_name='test-group', policy_name='policy1'):
|
||||
client = boto3.client('iam', region_name='us-east-1')
|
||||
client.create_group(GroupName=group_name)
|
||||
client.put_group_policy(
|
||||
GroupName=group_name,
|
||||
PolicyName=policy_name,
|
||||
PolicyDocument=json.dumps(policy_document)
|
||||
)
|
||||
client.add_user_to_group(GroupName=group_name, UserName=user_name)
|
||||
|
||||
|
||||
def create_group_with_multiple_policies_and_add_user(user_name, inline_policy_document,
|
||||
attached_policy_document, group_name='test-group',
|
||||
inline_policy_name='policy1', attached_policy_name='policy1'):
|
||||
client = boto3.client('iam', region_name='us-east-1')
|
||||
client.create_group(GroupName=group_name)
|
||||
client.put_group_policy(
|
||||
GroupName=group_name,
|
||||
PolicyName=inline_policy_name,
|
||||
PolicyDocument=json.dumps(inline_policy_document)
|
||||
)
|
||||
policy_arn = client.create_policy(
|
||||
PolicyName=attached_policy_name,
|
||||
PolicyDocument=json.dumps(attached_policy_document)
|
||||
)['Policy']['Arn']
|
||||
client.attach_group_policy(GroupName=group_name, PolicyArn=policy_arn)
|
||||
client.add_user_to_group(GroupName=group_name, UserName=user_name)
|
||||
|
||||
|
||||
@mock_iam
|
||||
@mock_sts
|
||||
def create_role_with_attached_policy_and_assume_it(role_name, trust_policy_document,
|
||||
policy_document, session_name='session1', policy_name='policy1'):
|
||||
iam_client = boto3.client('iam', region_name='us-east-1')
|
||||
sts_client = boto3.client('sts', region_name='us-east-1')
|
||||
role_arn = iam_client.create_role(
|
||||
RoleName=role_name,
|
||||
AssumeRolePolicyDocument=json.dumps(trust_policy_document)
|
||||
)['Role']['Arn']
|
||||
policy_arn = iam_client.create_policy(
|
||||
PolicyName=policy_name,
|
||||
PolicyDocument=json.dumps(policy_document)
|
||||
)['Policy']['Arn']
|
||||
iam_client.attach_role_policy(RoleName=role_name, PolicyArn=policy_arn)
|
||||
return sts_client.assume_role(RoleArn=role_arn, RoleSessionName=session_name)['Credentials']
|
||||
|
||||
|
||||
@mock_iam
|
||||
@mock_sts
|
||||
def create_role_with_inline_policy_and_assume_it(role_name, trust_policy_document,
|
||||
policy_document, session_name='session1', policy_name='policy1'):
|
||||
iam_client = boto3.client('iam', region_name='us-east-1')
|
||||
sts_client = boto3.client('sts', region_name='us-east-1')
|
||||
role_arn = iam_client.create_role(
|
||||
RoleName=role_name,
|
||||
AssumeRolePolicyDocument=json.dumps(trust_policy_document)
|
||||
)['Role']['Arn']
|
||||
iam_client.put_role_policy(
|
||||
RoleName=role_name,
|
||||
PolicyName=policy_name,
|
||||
PolicyDocument=json.dumps(policy_document)
|
||||
)
|
||||
return sts_client.assume_role(RoleArn=role_arn, RoleSessionName=session_name)['Credentials']
|
||||
|
||||
|
||||
@set_initial_no_auth_action_count(0)
|
||||
@mock_iam
|
||||
def test_invalid_client_token_id():
|
||||
client = boto3.client('iam', region_name='us-east-1', aws_access_key_id='invalid', aws_secret_access_key='invalid')
|
||||
with assert_raises(ClientError) as ex:
|
||||
client.get_user()
|
||||
ex.exception.response['Error']['Code'].should.equal('InvalidClientTokenId')
|
||||
ex.exception.response['ResponseMetadata']['HTTPStatusCode'].should.equal(403)
|
||||
ex.exception.response['Error']['Message'].should.equal('The security token included in the request is invalid.')
|
||||
|
||||
|
||||
@set_initial_no_auth_action_count(0)
|
||||
@mock_ec2
|
||||
def test_auth_failure():
|
||||
client = boto3.client('ec2', region_name='us-east-1', aws_access_key_id='invalid', aws_secret_access_key='invalid')
|
||||
with assert_raises(ClientError) as ex:
|
||||
client.describe_instances()
|
||||
ex.exception.response['Error']['Code'].should.equal('AuthFailure')
|
||||
ex.exception.response['ResponseMetadata']['HTTPStatusCode'].should.equal(401)
|
||||
ex.exception.response['Error']['Message'].should.equal('AWS was not able to validate the provided access credentials')
|
||||
|
||||
|
||||
@set_initial_no_auth_action_count(2)
|
||||
@mock_iam
|
||||
def test_signature_does_not_match():
|
||||
access_key = create_user_with_access_key()
|
||||
client = boto3.client('iam', region_name='us-east-1',
|
||||
aws_access_key_id=access_key['AccessKeyId'],
|
||||
aws_secret_access_key='invalid')
|
||||
with assert_raises(ClientError) as ex:
|
||||
client.get_user()
|
||||
ex.exception.response['Error']['Code'].should.equal('SignatureDoesNotMatch')
|
||||
ex.exception.response['ResponseMetadata']['HTTPStatusCode'].should.equal(403)
|
||||
ex.exception.response['Error']['Message'].should.equal('The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.')
|
||||
|
||||
|
||||
@set_initial_no_auth_action_count(2)
|
||||
@mock_ec2
|
||||
def test_auth_failure_with_valid_access_key_id():
|
||||
access_key = create_user_with_access_key()
|
||||
client = boto3.client('ec2', region_name='us-east-1',
|
||||
aws_access_key_id=access_key['AccessKeyId'],
|
||||
aws_secret_access_key='invalid')
|
||||
with assert_raises(ClientError) as ex:
|
||||
client.describe_instances()
|
||||
ex.exception.response['Error']['Code'].should.equal('AuthFailure')
|
||||
ex.exception.response['ResponseMetadata']['HTTPStatusCode'].should.equal(401)
|
||||
ex.exception.response['Error']['Message'].should.equal('AWS was not able to validate the provided access credentials')
|
||||
|
||||
|
||||
@set_initial_no_auth_action_count(2)
|
||||
@mock_ec2
|
||||
def test_access_denied_with_no_policy():
|
||||
user_name = 'test-user'
|
||||
access_key = create_user_with_access_key(user_name)
|
||||
client = boto3.client('ec2', region_name='us-east-1',
|
||||
aws_access_key_id=access_key['AccessKeyId'],
|
||||
aws_secret_access_key=access_key['SecretAccessKey'])
|
||||
with assert_raises(ClientError) as ex:
|
||||
client.describe_instances()
|
||||
ex.exception.response['Error']['Code'].should.equal('AccessDenied')
|
||||
ex.exception.response['ResponseMetadata']['HTTPStatusCode'].should.equal(403)
|
||||
ex.exception.response['Error']['Message'].should.equal(
|
||||
'User: arn:aws:iam::{account_id}:user/{user_name} is not authorized to perform: {operation}'.format(
|
||||
account_id=ACCOUNT_ID,
|
||||
user_name=user_name,
|
||||
operation="ec2:DescribeInstances"
|
||||
)
|
||||
)
|
||||
|
||||
|
||||
@set_initial_no_auth_action_count(3)
|
||||
@mock_ec2
|
||||
def test_access_denied_with_not_allowing_policy():
|
||||
user_name = 'test-user'
|
||||
inline_policy_document = {
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"ec2:Describe*"
|
||||
],
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
access_key = create_user_with_access_key_and_inline_policy(user_name, inline_policy_document)
|
||||
client = boto3.client('ec2', region_name='us-east-1',
|
||||
aws_access_key_id=access_key['AccessKeyId'],
|
||||
aws_secret_access_key=access_key['SecretAccessKey'])
|
||||
with assert_raises(ClientError) as ex:
|
||||
client.run_instances(MaxCount=1, MinCount=1)
|
||||
ex.exception.response['Error']['Code'].should.equal('AccessDenied')
|
||||
ex.exception.response['ResponseMetadata']['HTTPStatusCode'].should.equal(403)
|
||||
ex.exception.response['Error']['Message'].should.equal(
|
||||
'User: arn:aws:iam::{account_id}:user/{user_name} is not authorized to perform: {operation}'.format(
|
||||
account_id=ACCOUNT_ID,
|
||||
user_name=user_name,
|
||||
operation="ec2:RunInstances"
|
||||
)
|
||||
)
|
||||
|
||||
|
||||
@set_initial_no_auth_action_count(3)
|
||||
@mock_ec2
|
||||
def test_access_denied_with_denying_policy():
|
||||
user_name = 'test-user'
|
||||
inline_policy_document = {
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"ec2:*",
|
||||
],
|
||||
"Resource": "*"
|
||||
},
|
||||
{
|
||||
"Effect": "Deny",
|
||||
"Action": "ec2:CreateVpc",
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
access_key = create_user_with_access_key_and_inline_policy(user_name, inline_policy_document)
|
||||
client = boto3.client('ec2', region_name='us-east-1',
|
||||
aws_access_key_id=access_key['AccessKeyId'],
|
||||
aws_secret_access_key=access_key['SecretAccessKey'])
|
||||
with assert_raises(ClientError) as ex:
|
||||
client.create_vpc(CidrBlock="10.0.0.0/16")
|
||||
ex.exception.response['Error']['Code'].should.equal('AccessDenied')
|
||||
ex.exception.response['ResponseMetadata']['HTTPStatusCode'].should.equal(403)
|
||||
ex.exception.response['Error']['Message'].should.equal(
|
||||
'User: arn:aws:iam::{account_id}:user/{user_name} is not authorized to perform: {operation}'.format(
|
||||
account_id=ACCOUNT_ID,
|
||||
user_name=user_name,
|
||||
operation="ec2:CreateVpc"
|
||||
)
|
||||
)
|
||||
|
||||
|
||||
@set_initial_no_auth_action_count(3)
|
||||
@mock_sts
|
||||
def test_get_caller_identity_allowed_with_denying_policy():
|
||||
user_name = 'test-user'
|
||||
inline_policy_document = {
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Deny",
|
||||
"Action": "sts:GetCallerIdentity",
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
access_key = create_user_with_access_key_and_inline_policy(user_name, inline_policy_document)
|
||||
client = boto3.client('sts', region_name='us-east-1',
|
||||
aws_access_key_id=access_key['AccessKeyId'],
|
||||
aws_secret_access_key=access_key['SecretAccessKey'])
|
||||
client.get_caller_identity().should.be.a(dict)
|
||||
|
||||
|
||||
@set_initial_no_auth_action_count(3)
|
||||
@mock_ec2
|
||||
def test_allowed_with_wildcard_action():
|
||||
user_name = 'test-user'
|
||||
inline_policy_document = {
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": "ec2:Describe*",
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
access_key = create_user_with_access_key_and_inline_policy(user_name, inline_policy_document)
|
||||
client = boto3.client('ec2', region_name='us-east-1',
|
||||
aws_access_key_id=access_key['AccessKeyId'],
|
||||
aws_secret_access_key=access_key['SecretAccessKey'])
|
||||
client.describe_tags()['Tags'].should.be.empty
|
||||
|
||||
|
||||
@set_initial_no_auth_action_count(4)
|
||||
@mock_iam
|
||||
def test_allowed_with_explicit_action_in_attached_policy():
|
||||
user_name = 'test-user'
|
||||
attached_policy_document = {
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": "iam:ListGroups",
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
access_key = create_user_with_access_key_and_attached_policy(user_name, attached_policy_document)
|
||||
client = boto3.client('iam', region_name='us-east-1',
|
||||
aws_access_key_id=access_key['AccessKeyId'],
|
||||
aws_secret_access_key=access_key['SecretAccessKey'])
|
||||
client.list_groups()['Groups'].should.be.empty
|
||||
|
||||
|
||||
@set_initial_no_auth_action_count(8)
|
||||
@mock_s3
|
||||
@mock_iam
|
||||
def test_s3_access_denied_with_denying_attached_group_policy():
|
||||
user_name = 'test-user'
|
||||
attached_policy_document = {
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": "s3:ListAllMyBuckets",
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
group_attached_policy_document = {
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Deny",
|
||||
"Action": "s3:List*",
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
access_key = create_user_with_access_key_and_attached_policy(user_name, attached_policy_document)
|
||||
create_group_with_attached_policy_and_add_user(user_name, group_attached_policy_document)
|
||||
client = boto3.client('s3', region_name='us-east-1',
|
||||
aws_access_key_id=access_key['AccessKeyId'],
|
||||
aws_secret_access_key=access_key['SecretAccessKey'])
|
||||
with assert_raises(ClientError) as ex:
|
||||
client.list_buckets()
|
||||
ex.exception.response['Error']['Code'].should.equal('AccessDenied')
|
||||
ex.exception.response['ResponseMetadata']['HTTPStatusCode'].should.equal(403)
|
||||
ex.exception.response['Error']['Message'].should.equal('Access Denied')
|
||||
|
||||
|
||||
@set_initial_no_auth_action_count(6)
|
||||
@mock_s3
|
||||
@mock_iam
|
||||
def test_s3_access_denied_with_denying_inline_group_policy():
|
||||
user_name = 'test-user'
|
||||
bucket_name = 'test-bucket'
|
||||
inline_policy_document = {
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": "*",
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
group_inline_policy_document = {
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Deny",
|
||||
"Action": "s3:GetObject",
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
access_key = create_user_with_access_key_and_inline_policy(user_name, inline_policy_document)
|
||||
create_group_with_inline_policy_and_add_user(user_name, group_inline_policy_document)
|
||||
client = boto3.client('s3', region_name='us-east-1',
|
||||
aws_access_key_id=access_key['AccessKeyId'],
|
||||
aws_secret_access_key=access_key['SecretAccessKey'])
|
||||
client.create_bucket(Bucket=bucket_name)
|
||||
with assert_raises(ClientError) as ex:
|
||||
client.get_object(Bucket=bucket_name, Key='sdfsdf')
|
||||
ex.exception.response['Error']['Code'].should.equal('AccessDenied')
|
||||
ex.exception.response['ResponseMetadata']['HTTPStatusCode'].should.equal(403)
|
||||
ex.exception.response['Error']['Message'].should.equal('Access Denied')
|
||||
|
||||
|
||||
@set_initial_no_auth_action_count(10)
|
||||
@mock_iam
|
||||
@mock_ec2
|
||||
def test_access_denied_with_many_irrelevant_policies():
|
||||
user_name = 'test-user'
|
||||
inline_policy_document = {
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": "ec2:Describe*",
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
attached_policy_document = {
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": "s3:*",
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
group_inline_policy_document = {
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Deny",
|
||||
"Action": "iam:List*",
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
group_attached_policy_document = {
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Deny",
|
||||
"Action": "lambda:*",
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
access_key = create_user_with_access_key_and_multiple_policies(user_name, inline_policy_document,
|
||||
attached_policy_document)
|
||||
create_group_with_multiple_policies_and_add_user(user_name, group_inline_policy_document,
|
||||
group_attached_policy_document)
|
||||
client = boto3.client('ec2', region_name='us-east-1',
|
||||
aws_access_key_id=access_key['AccessKeyId'],
|
||||
aws_secret_access_key=access_key['SecretAccessKey'])
|
||||
with assert_raises(ClientError) as ex:
|
||||
client.create_key_pair(KeyName="TestKey")
|
||||
ex.exception.response['Error']['Code'].should.equal('AccessDenied')
|
||||
ex.exception.response['ResponseMetadata']['HTTPStatusCode'].should.equal(403)
|
||||
ex.exception.response['Error']['Message'].should.equal(
|
||||
'User: arn:aws:iam::{account_id}:user/{user_name} is not authorized to perform: {operation}'.format(
|
||||
account_id=ACCOUNT_ID,
|
||||
user_name=user_name,
|
||||
operation="ec2:CreateKeyPair"
|
||||
)
|
||||
)
|
||||
|
||||
|
||||
@set_initial_no_auth_action_count(4)
|
||||
@mock_iam
|
||||
@mock_sts
|
||||
@mock_ec2
|
||||
@mock_elbv2
|
||||
def test_allowed_with_temporary_credentials():
|
||||
role_name = 'test-role'
|
||||
trust_policy_document = {
|
||||
"Version": "2012-10-17",
|
||||
"Statement": {
|
||||
"Effect": "Allow",
|
||||
"Principal": {"AWS": "arn:aws:iam::{account_id}:root".format(account_id=ACCOUNT_ID)},
|
||||
"Action": "sts:AssumeRole"
|
||||
}
|
||||
}
|
||||
attached_policy_document = {
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"elasticloadbalancing:CreateLoadBalancer",
|
||||
"ec2:DescribeSubnets"
|
||||
],
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
credentials = create_role_with_attached_policy_and_assume_it(role_name, trust_policy_document, attached_policy_document)
|
||||
elbv2_client = boto3.client('elbv2', region_name='us-east-1',
|
||||
aws_access_key_id=credentials['AccessKeyId'],
|
||||
aws_secret_access_key=credentials['SecretAccessKey'],
|
||||
aws_session_token=credentials['SessionToken'])
|
||||
ec2_client = boto3.client('ec2', region_name='us-east-1',
|
||||
aws_access_key_id=credentials['AccessKeyId'],
|
||||
aws_secret_access_key=credentials['SecretAccessKey'],
|
||||
aws_session_token=credentials['SessionToken'])
|
||||
subnets = ec2_client.describe_subnets()['Subnets']
|
||||
len(subnets).should.be.greater_than(1)
|
||||
elbv2_client.create_load_balancer(
|
||||
Name='test-load-balancer',
|
||||
Subnets=[
|
||||
subnets[0]['SubnetId'],
|
||||
subnets[1]['SubnetId']
|
||||
]
|
||||
)['LoadBalancers'].should.have.length_of(1)
|
||||
|
||||
|
||||
@set_initial_no_auth_action_count(3)
|
||||
@mock_iam
|
||||
@mock_sts
|
||||
@mock_rds2
|
||||
def test_access_denied_with_temporary_credentials():
|
||||
role_name = 'test-role'
|
||||
session_name = 'test-session'
|
||||
trust_policy_document = {
|
||||
"Version": "2012-10-17",
|
||||
"Statement": {
|
||||
"Effect": "Allow",
|
||||
"Principal": {"AWS": "arn:aws:iam::{account_id}:root".format(account_id=ACCOUNT_ID)},
|
||||
"Action": "sts:AssumeRole"
|
||||
}
|
||||
}
|
||||
attached_policy_document = {
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
'rds:Describe*'
|
||||
],
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
credentials = create_role_with_inline_policy_and_assume_it(role_name, trust_policy_document,
|
||||
attached_policy_document, session_name)
|
||||
client = boto3.client('rds', region_name='us-east-1',
|
||||
aws_access_key_id=credentials['AccessKeyId'],
|
||||
aws_secret_access_key=credentials['SecretAccessKey'],
|
||||
aws_session_token=credentials['SessionToken'])
|
||||
with assert_raises(ClientError) as ex:
|
||||
client.create_db_instance(
|
||||
DBInstanceIdentifier='test-db-instance',
|
||||
DBInstanceClass='db.t3',
|
||||
Engine='aurora-postgresql'
|
||||
)
|
||||
ex.exception.response['Error']['Code'].should.equal('AccessDenied')
|
||||
ex.exception.response['ResponseMetadata']['HTTPStatusCode'].should.equal(403)
|
||||
ex.exception.response['Error']['Message'].should.equal(
|
||||
'User: arn:aws:sts::{account_id}:assumed-role/{role_name}/{session_name} is not authorized to perform: {operation}'.format(
|
||||
account_id=ACCOUNT_ID,
|
||||
role_name=role_name,
|
||||
session_name=session_name,
|
||||
operation="rds:CreateDBInstance"
|
||||
)
|
||||
)
|
||||
|
||||
|
||||
@set_initial_no_auth_action_count(3)
|
||||
@mock_iam
|
||||
def test_get_user_from_credentials():
|
||||
user_name = 'new-test-user'
|
||||
inline_policy_document = {
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": "iam:*",
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
access_key = create_user_with_access_key_and_inline_policy(user_name, inline_policy_document)
|
||||
client = boto3.client('iam', region_name='us-east-1',
|
||||
aws_access_key_id=access_key['AccessKeyId'],
|
||||
aws_secret_access_key=access_key['SecretAccessKey'])
|
||||
client.get_user()['User']['UserName'].should.equal(user_name)
|
||||
|
||||
|
||||
@set_initial_no_auth_action_count(0)
|
||||
@mock_s3
|
||||
def test_s3_invalid_access_key_id():
|
||||
client = boto3.client('s3', region_name='us-east-1', aws_access_key_id='invalid', aws_secret_access_key='invalid')
|
||||
with assert_raises(ClientError) as ex:
|
||||
client.list_buckets()
|
||||
ex.exception.response['Error']['Code'].should.equal('InvalidAccessKeyId')
|
||||
ex.exception.response['ResponseMetadata']['HTTPStatusCode'].should.equal(403)
|
||||
ex.exception.response['Error']['Message'].should.equal('The AWS Access Key Id you provided does not exist in our records.')
|
||||
|
||||
|
||||
@set_initial_no_auth_action_count(3)
|
||||
@mock_s3
|
||||
@mock_iam
|
||||
def test_s3_signature_does_not_match():
|
||||
bucket_name = 'test-bucket'
|
||||
access_key = create_user_with_access_key()
|
||||
client = boto3.client('s3', region_name='us-east-1',
|
||||
aws_access_key_id=access_key['AccessKeyId'],
|
||||
aws_secret_access_key='invalid')
|
||||
client.create_bucket(Bucket=bucket_name)
|
||||
with assert_raises(ClientError) as ex:
|
||||
client.put_object(Bucket=bucket_name, Key="abc")
|
||||
ex.exception.response['Error']['Code'].should.equal('SignatureDoesNotMatch')
|
||||
ex.exception.response['ResponseMetadata']['HTTPStatusCode'].should.equal(403)
|
||||
ex.exception.response['Error']['Message'].should.equal('The request signature we calculated does not match the signature you provided. Check your key and signing method.')
|
||||
|
||||
|
||||
@set_initial_no_auth_action_count(7)
|
||||
@mock_s3
|
||||
@mock_iam
|
||||
def test_s3_access_denied_not_action():
|
||||
user_name = 'test-user'
|
||||
bucket_name = 'test-bucket'
|
||||
inline_policy_document = {
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": "*",
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
group_inline_policy_document = {
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Deny",
|
||||
"NotAction": "iam:GetUser",
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
access_key = create_user_with_access_key_and_inline_policy(user_name, inline_policy_document)
|
||||
create_group_with_inline_policy_and_add_user(user_name, group_inline_policy_document)
|
||||
client = boto3.client('s3', region_name='us-east-1',
|
||||
aws_access_key_id=access_key['AccessKeyId'],
|
||||
aws_secret_access_key=access_key['SecretAccessKey'])
|
||||
client.create_bucket(Bucket=bucket_name)
|
||||
with assert_raises(ClientError) as ex:
|
||||
client.delete_object(Bucket=bucket_name, Key='sdfsdf')
|
||||
ex.exception.response['Error']['Code'].should.equal('AccessDenied')
|
||||
ex.exception.response['ResponseMetadata']['HTTPStatusCode'].should.equal(403)
|
||||
ex.exception.response['Error']['Message'].should.equal('Access Denied')
|
||||
|
||||
|
||||
@set_initial_no_auth_action_count(4)
|
||||
@mock_iam
|
||||
@mock_sts
|
||||
@mock_s3
|
||||
def test_s3_invalid_token_with_temporary_credentials():
|
||||
role_name = 'test-role'
|
||||
session_name = 'test-session'
|
||||
bucket_name = 'test-bucket-888'
|
||||
trust_policy_document = {
|
||||
"Version": "2012-10-17",
|
||||
"Statement": {
|
||||
"Effect": "Allow",
|
||||
"Principal": {"AWS": "arn:aws:iam::{account_id}:root".format(account_id=ACCOUNT_ID)},
|
||||
"Action": "sts:AssumeRole"
|
||||
}
|
||||
}
|
||||
attached_policy_document = {
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
'*'
|
||||
],
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
credentials = create_role_with_inline_policy_and_assume_it(role_name, trust_policy_document,
|
||||
attached_policy_document, session_name)
|
||||
client = boto3.client('s3', region_name='us-east-1',
|
||||
aws_access_key_id=credentials['AccessKeyId'],
|
||||
aws_secret_access_key=credentials['SecretAccessKey'],
|
||||
aws_session_token='invalid')
|
||||
client.create_bucket(Bucket=bucket_name)
|
||||
with assert_raises(ClientError) as ex:
|
||||
client.list_bucket_metrics_configurations(Bucket=bucket_name)
|
||||
ex.exception.response['Error']['Code'].should.equal('InvalidToken')
|
||||
ex.exception.response['ResponseMetadata']['HTTPStatusCode'].should.equal(400)
|
||||
ex.exception.response['Error']['Message'].should.equal('The provided token is malformed or otherwise invalid.')
|
||||
12
tests/test_core/test_context_manager.py
Normal file
12
tests/test_core/test_context_manager.py
Normal file
|
|
@ -0,0 +1,12 @@
|
|||
import sure # noqa
|
||||
import boto3
|
||||
from moto import mock_sqs, settings
|
||||
|
||||
|
||||
def test_context_manager_returns_mock():
|
||||
with mock_sqs() as sqs_mock:
|
||||
conn = boto3.client("sqs", region_name='us-west-1')
|
||||
conn.create_queue(QueueName="queue1")
|
||||
|
||||
if not settings.TEST_SERVER_MODE:
|
||||
list(sqs_mock.backends['us-west-1'].queues.keys()).should.equal(['queue1'])
|
||||
48
tests/test_core/test_socket.py
Normal file
48
tests/test_core/test_socket.py
Normal file
|
|
@ -0,0 +1,48 @@
|
|||
import unittest
|
||||
from moto import mock_dynamodb2_deprecated, mock_dynamodb2
|
||||
import socket
|
||||
|
||||
from six import PY3
|
||||
|
||||
|
||||
class TestSocketPair(unittest.TestCase):
|
||||
|
||||
@mock_dynamodb2_deprecated
|
||||
def test_asyncio_deprecated(self):
|
||||
if PY3:
|
||||
self.assertIn(
|
||||
'moto.packages.httpretty.core.fakesock.socket',
|
||||
str(socket.socket),
|
||||
'Our mock should be present'
|
||||
)
|
||||
import asyncio
|
||||
self.assertIsNotNone(asyncio.get_event_loop())
|
||||
|
||||
@mock_dynamodb2_deprecated
|
||||
def test_socket_pair_deprecated(self):
|
||||
|
||||
# In Python2, the fakesocket is not set, for some reason.
|
||||
if PY3:
|
||||
self.assertIn(
|
||||
'moto.packages.httpretty.core.fakesock.socket',
|
||||
str(socket.socket),
|
||||
'Our mock should be present'
|
||||
)
|
||||
a, b = socket.socketpair()
|
||||
self.assertIsNotNone(a)
|
||||
self.assertIsNotNone(b)
|
||||
if a:
|
||||
a.close()
|
||||
if b:
|
||||
b.close()
|
||||
|
||||
|
||||
@mock_dynamodb2
|
||||
def test_socket_pair(self):
|
||||
a, b = socket.socketpair()
|
||||
self.assertIsNotNone(a)
|
||||
self.assertIsNotNone(b)
|
||||
if a:
|
||||
a.close()
|
||||
if b:
|
||||
b.close()
|
||||
415
tests/test_ec2/test_launch_templates.py
Normal file
415
tests/test_ec2/test_launch_templates.py
Normal file
|
|
@ -0,0 +1,415 @@
|
|||
import boto3
|
||||
import sure # noqa
|
||||
|
||||
from nose.tools import assert_raises
|
||||
from botocore.client import ClientError
|
||||
|
||||
from moto import mock_ec2
|
||||
|
||||
|
||||
@mock_ec2
|
||||
def test_launch_template_create():
|
||||
cli = boto3.client("ec2", region_name="us-east-1")
|
||||
|
||||
resp = cli.create_launch_template(
|
||||
LaunchTemplateName="test-template",
|
||||
|
||||
# the absolute minimum needed to create a template without other resources
|
||||
LaunchTemplateData={
|
||||
"TagSpecifications": [{
|
||||
"ResourceType": "instance",
|
||||
"Tags": [{
|
||||
"Key": "test",
|
||||
"Value": "value",
|
||||
}],
|
||||
}],
|
||||
},
|
||||
)
|
||||
|
||||
resp.should.have.key("LaunchTemplate")
|
||||
lt = resp["LaunchTemplate"]
|
||||
lt["LaunchTemplateName"].should.equal("test-template")
|
||||
lt["DefaultVersionNumber"].should.equal(1)
|
||||
lt["LatestVersionNumber"].should.equal(1)
|
||||
|
||||
with assert_raises(ClientError) as ex:
|
||||
cli.create_launch_template(
|
||||
LaunchTemplateName="test-template",
|
||||
LaunchTemplateData={
|
||||
"TagSpecifications": [{
|
||||
"ResourceType": "instance",
|
||||
"Tags": [{
|
||||
"Key": "test",
|
||||
"Value": "value",
|
||||
}],
|
||||
}],
|
||||
},
|
||||
)
|
||||
|
||||
str(ex.exception).should.equal(
|
||||
'An error occurred (InvalidLaunchTemplateName.AlreadyExistsException) when calling the CreateLaunchTemplate operation: Launch template name already in use.')
|
||||
|
||||
|
||||
@mock_ec2
|
||||
def test_describe_launch_template_versions():
|
||||
template_data = {
|
||||
"ImageId": "ami-abc123",
|
||||
"DisableApiTermination": False,
|
||||
"TagSpecifications": [{
|
||||
"ResourceType": "instance",
|
||||
"Tags": [{
|
||||
"Key": "test",
|
||||
"Value": "value",
|
||||
}],
|
||||
}],
|
||||
"SecurityGroupIds": [
|
||||
"sg-1234",
|
||||
"sg-ab5678",
|
||||
],
|
||||
}
|
||||
|
||||
cli = boto3.client("ec2", region_name="us-east-1")
|
||||
|
||||
create_resp = cli.create_launch_template(
|
||||
LaunchTemplateName="test-template",
|
||||
LaunchTemplateData=template_data)
|
||||
|
||||
# test using name
|
||||
resp = cli.describe_launch_template_versions(
|
||||
LaunchTemplateName="test-template",
|
||||
Versions=['1'])
|
||||
|
||||
templ = resp["LaunchTemplateVersions"][0]["LaunchTemplateData"]
|
||||
templ.should.equal(template_data)
|
||||
|
||||
# test using id
|
||||
resp = cli.describe_launch_template_versions(
|
||||
LaunchTemplateId=create_resp["LaunchTemplate"]["LaunchTemplateId"],
|
||||
Versions=['1'])
|
||||
|
||||
templ = resp["LaunchTemplateVersions"][0]["LaunchTemplateData"]
|
||||
templ.should.equal(template_data)
|
||||
|
||||
|
||||
@mock_ec2
|
||||
def test_create_launch_template_version():
|
||||
cli = boto3.client("ec2", region_name="us-east-1")
|
||||
|
||||
create_resp = cli.create_launch_template(
|
||||
LaunchTemplateName="test-template",
|
||||
LaunchTemplateData={
|
||||
"ImageId": "ami-abc123"
|
||||
})
|
||||
|
||||
version_resp = cli.create_launch_template_version(
|
||||
LaunchTemplateName="test-template",
|
||||
LaunchTemplateData={
|
||||
"ImageId": "ami-def456"
|
||||
},
|
||||
VersionDescription="new ami")
|
||||
|
||||
version_resp.should.have.key("LaunchTemplateVersion")
|
||||
version = version_resp["LaunchTemplateVersion"]
|
||||
version["DefaultVersion"].should.equal(False)
|
||||
version["LaunchTemplateId"].should.equal(create_resp["LaunchTemplate"]["LaunchTemplateId"])
|
||||
version["VersionDescription"].should.equal("new ami")
|
||||
version["VersionNumber"].should.equal(2)
|
||||
|
||||
|
||||
@mock_ec2
|
||||
def test_create_launch_template_version_by_id():
|
||||
cli = boto3.client("ec2", region_name="us-east-1")
|
||||
|
||||
create_resp = cli.create_launch_template(
|
||||
LaunchTemplateName="test-template",
|
||||
LaunchTemplateData={
|
||||
"ImageId": "ami-abc123"
|
||||
})
|
||||
|
||||
version_resp = cli.create_launch_template_version(
|
||||
LaunchTemplateId=create_resp["LaunchTemplate"]["LaunchTemplateId"],
|
||||
LaunchTemplateData={
|
||||
"ImageId": "ami-def456"
|
||||
},
|
||||
VersionDescription="new ami")
|
||||
|
||||
version_resp.should.have.key("LaunchTemplateVersion")
|
||||
version = version_resp["LaunchTemplateVersion"]
|
||||
version["DefaultVersion"].should.equal(False)
|
||||
version["LaunchTemplateId"].should.equal(create_resp["LaunchTemplate"]["LaunchTemplateId"])
|
||||
version["VersionDescription"].should.equal("new ami")
|
||||
version["VersionNumber"].should.equal(2)
|
||||
|
||||
|
||||
@mock_ec2
|
||||
def test_describe_launch_template_versions_with_multiple_versions():
|
||||
cli = boto3.client("ec2", region_name="us-east-1")
|
||||
|
||||
cli.create_launch_template(
|
||||
LaunchTemplateName="test-template",
|
||||
LaunchTemplateData={
|
||||
"ImageId": "ami-abc123"
|
||||
})
|
||||
|
||||
cli.create_launch_template_version(
|
||||
LaunchTemplateName="test-template",
|
||||
LaunchTemplateData={
|
||||
"ImageId": "ami-def456"
|
||||
},
|
||||
VersionDescription="new ami")
|
||||
|
||||
resp = cli.describe_launch_template_versions(
|
||||
LaunchTemplateName="test-template")
|
||||
|
||||
resp["LaunchTemplateVersions"].should.have.length_of(2)
|
||||
resp["LaunchTemplateVersions"][0]["LaunchTemplateData"]["ImageId"].should.equal("ami-abc123")
|
||||
resp["LaunchTemplateVersions"][1]["LaunchTemplateData"]["ImageId"].should.equal("ami-def456")
|
||||
|
||||
|
||||
@mock_ec2
|
||||
def test_describe_launch_template_versions_with_versions_option():
|
||||
cli = boto3.client("ec2", region_name="us-east-1")
|
||||
|
||||
cli.create_launch_template(
|
||||
LaunchTemplateName="test-template",
|
||||
LaunchTemplateData={
|
||||
"ImageId": "ami-abc123"
|
||||
})
|
||||
|
||||
cli.create_launch_template_version(
|
||||
LaunchTemplateName="test-template",
|
||||
LaunchTemplateData={
|
||||
"ImageId": "ami-def456"
|
||||
},
|
||||
VersionDescription="new ami")
|
||||
|
||||
cli.create_launch_template_version(
|
||||
LaunchTemplateName="test-template",
|
||||
LaunchTemplateData={
|
||||
"ImageId": "ami-hij789"
|
||||
},
|
||||
VersionDescription="new ami, again")
|
||||
|
||||
resp = cli.describe_launch_template_versions(
|
||||
LaunchTemplateName="test-template",
|
||||
Versions=["2", "3"])
|
||||
|
||||
resp["LaunchTemplateVersions"].should.have.length_of(2)
|
||||
resp["LaunchTemplateVersions"][0]["LaunchTemplateData"]["ImageId"].should.equal("ami-def456")
|
||||
resp["LaunchTemplateVersions"][1]["LaunchTemplateData"]["ImageId"].should.equal("ami-hij789")
|
||||
|
||||
|
||||
@mock_ec2
|
||||
def test_describe_launch_template_versions_with_min():
|
||||
cli = boto3.client("ec2", region_name="us-east-1")
|
||||
|
||||
cli.create_launch_template(
|
||||
LaunchTemplateName="test-template",
|
||||
LaunchTemplateData={
|
||||
"ImageId": "ami-abc123"
|
||||
})
|
||||
|
||||
cli.create_launch_template_version(
|
||||
LaunchTemplateName="test-template",
|
||||
LaunchTemplateData={
|
||||
"ImageId": "ami-def456"
|
||||
},
|
||||
VersionDescription="new ami")
|
||||
|
||||
cli.create_launch_template_version(
|
||||
LaunchTemplateName="test-template",
|
||||
LaunchTemplateData={
|
||||
"ImageId": "ami-hij789"
|
||||
},
|
||||
VersionDescription="new ami, again")
|
||||
|
||||
resp = cli.describe_launch_template_versions(
|
||||
LaunchTemplateName="test-template",
|
||||
MinVersion="2")
|
||||
|
||||
resp["LaunchTemplateVersions"].should.have.length_of(2)
|
||||
resp["LaunchTemplateVersions"][0]["LaunchTemplateData"]["ImageId"].should.equal("ami-def456")
|
||||
resp["LaunchTemplateVersions"][1]["LaunchTemplateData"]["ImageId"].should.equal("ami-hij789")
|
||||
|
||||
|
||||
@mock_ec2
|
||||
def test_describe_launch_template_versions_with_max():
|
||||
cli = boto3.client("ec2", region_name="us-east-1")
|
||||
|
||||
cli.create_launch_template(
|
||||
LaunchTemplateName="test-template",
|
||||
LaunchTemplateData={
|
||||
"ImageId": "ami-abc123"
|
||||
})
|
||||
|
||||
cli.create_launch_template_version(
|
||||
LaunchTemplateName="test-template",
|
||||
LaunchTemplateData={
|
||||
"ImageId": "ami-def456"
|
||||
},
|
||||
VersionDescription="new ami")
|
||||
|
||||
cli.create_launch_template_version(
|
||||
LaunchTemplateName="test-template",
|
||||
LaunchTemplateData={
|
||||
"ImageId": "ami-hij789"
|
||||
},
|
||||
VersionDescription="new ami, again")
|
||||
|
||||
resp = cli.describe_launch_template_versions(
|
||||
LaunchTemplateName="test-template",
|
||||
MaxVersion="2")
|
||||
|
||||
resp["LaunchTemplateVersions"].should.have.length_of(2)
|
||||
resp["LaunchTemplateVersions"][0]["LaunchTemplateData"]["ImageId"].should.equal("ami-abc123")
|
||||
resp["LaunchTemplateVersions"][1]["LaunchTemplateData"]["ImageId"].should.equal("ami-def456")
|
||||
|
||||
|
||||
@mock_ec2
|
||||
def test_describe_launch_template_versions_with_min_and_max():
|
||||
cli = boto3.client("ec2", region_name="us-east-1")
|
||||
|
||||
cli.create_launch_template(
|
||||
LaunchTemplateName="test-template",
|
||||
LaunchTemplateData={
|
||||
"ImageId": "ami-abc123"
|
||||
})
|
||||
|
||||
cli.create_launch_template_version(
|
||||
LaunchTemplateName="test-template",
|
||||
LaunchTemplateData={
|
||||
"ImageId": "ami-def456"
|
||||
},
|
||||
VersionDescription="new ami")
|
||||
|
||||
cli.create_launch_template_version(
|
||||
LaunchTemplateName="test-template",
|
||||
LaunchTemplateData={
|
||||
"ImageId": "ami-hij789"
|
||||
},
|
||||
VersionDescription="new ami, again")
|
||||
|
||||
cli.create_launch_template_version(
|
||||
LaunchTemplateName="test-template",
|
||||
LaunchTemplateData={
|
||||
"ImageId": "ami-345abc"
|
||||
},
|
||||
VersionDescription="new ami, because why not")
|
||||
|
||||
resp = cli.describe_launch_template_versions(
|
||||
LaunchTemplateName="test-template",
|
||||
MinVersion="2",
|
||||
MaxVersion="3")
|
||||
|
||||
resp["LaunchTemplateVersions"].should.have.length_of(2)
|
||||
resp["LaunchTemplateVersions"][0]["LaunchTemplateData"]["ImageId"].should.equal("ami-def456")
|
||||
resp["LaunchTemplateVersions"][1]["LaunchTemplateData"]["ImageId"].should.equal("ami-hij789")
|
||||
|
||||
|
||||
@mock_ec2
|
||||
def test_describe_launch_templates():
|
||||
cli = boto3.client("ec2", region_name="us-east-1")
|
||||
|
||||
lt_ids = []
|
||||
r = cli.create_launch_template(
|
||||
LaunchTemplateName="test-template",
|
||||
LaunchTemplateData={
|
||||
"ImageId": "ami-abc123"
|
||||
})
|
||||
lt_ids.append(r["LaunchTemplate"]["LaunchTemplateId"])
|
||||
|
||||
r = cli.create_launch_template(
|
||||
LaunchTemplateName="test-template2",
|
||||
LaunchTemplateData={
|
||||
"ImageId": "ami-abc123"
|
||||
})
|
||||
lt_ids.append(r["LaunchTemplate"]["LaunchTemplateId"])
|
||||
|
||||
# general call, all templates
|
||||
resp = cli.describe_launch_templates()
|
||||
resp.should.have.key("LaunchTemplates")
|
||||
resp["LaunchTemplates"].should.have.length_of(2)
|
||||
resp["LaunchTemplates"][0]["LaunchTemplateName"].should.equal("test-template")
|
||||
resp["LaunchTemplates"][1]["LaunchTemplateName"].should.equal("test-template2")
|
||||
|
||||
# filter by names
|
||||
resp = cli.describe_launch_templates(
|
||||
LaunchTemplateNames=["test-template2", "test-template"])
|
||||
resp.should.have.key("LaunchTemplates")
|
||||
resp["LaunchTemplates"].should.have.length_of(2)
|
||||
resp["LaunchTemplates"][0]["LaunchTemplateName"].should.equal("test-template2")
|
||||
resp["LaunchTemplates"][1]["LaunchTemplateName"].should.equal("test-template")
|
||||
|
||||
# filter by ids
|
||||
resp = cli.describe_launch_templates(LaunchTemplateIds=lt_ids)
|
||||
resp.should.have.key("LaunchTemplates")
|
||||
resp["LaunchTemplates"].should.have.length_of(2)
|
||||
resp["LaunchTemplates"][0]["LaunchTemplateName"].should.equal("test-template")
|
||||
resp["LaunchTemplates"][1]["LaunchTemplateName"].should.equal("test-template2")
|
||||
|
||||
|
||||
@mock_ec2
|
||||
def test_describe_launch_templates_with_filters():
|
||||
cli = boto3.client("ec2", region_name="us-east-1")
|
||||
|
||||
r = cli.create_launch_template(
|
||||
LaunchTemplateName="test-template",
|
||||
LaunchTemplateData={
|
||||
"ImageId": "ami-abc123"
|
||||
})
|
||||
|
||||
cli.create_tags(
|
||||
Resources=[r["LaunchTemplate"]["LaunchTemplateId"]],
|
||||
Tags=[
|
||||
{"Key": "tag1", "Value": "a value"},
|
||||
{"Key": "another-key", "Value": "this value"},
|
||||
])
|
||||
|
||||
cli.create_launch_template(
|
||||
LaunchTemplateName="no-tags",
|
||||
LaunchTemplateData={
|
||||
"ImageId": "ami-abc123"
|
||||
})
|
||||
|
||||
resp = cli.describe_launch_templates(Filters=[{
|
||||
"Name": "tag:tag1", "Values": ["a value"]
|
||||
}])
|
||||
|
||||
resp["LaunchTemplates"].should.have.length_of(1)
|
||||
resp["LaunchTemplates"][0]["LaunchTemplateName"].should.equal("test-template")
|
||||
|
||||
resp = cli.describe_launch_templates(Filters=[{
|
||||
"Name": "launch-template-name", "Values": ["no-tags"]
|
||||
}])
|
||||
resp["LaunchTemplates"].should.have.length_of(1)
|
||||
resp["LaunchTemplates"][0]["LaunchTemplateName"].should.equal("no-tags")
|
||||
|
||||
|
||||
@mock_ec2
|
||||
def test_create_launch_template_with_tag_spec():
|
||||
cli = boto3.client("ec2", region_name="us-east-1")
|
||||
|
||||
cli.create_launch_template(
|
||||
LaunchTemplateName="test-template",
|
||||
LaunchTemplateData={"ImageId": "ami-abc123"},
|
||||
TagSpecifications=[{
|
||||
"ResourceType": "instance",
|
||||
"Tags": [
|
||||
{"Key": "key", "Value": "value"}
|
||||
]
|
||||
}],
|
||||
)
|
||||
|
||||
resp = cli.describe_launch_template_versions(
|
||||
LaunchTemplateName="test-template",
|
||||
Versions=["1"])
|
||||
version = resp["LaunchTemplateVersions"][0]
|
||||
|
||||
version["LaunchTemplateData"].should.have.key("TagSpecifications")
|
||||
version["LaunchTemplateData"]["TagSpecifications"].should.have.length_of(1)
|
||||
version["LaunchTemplateData"]["TagSpecifications"][0].should.equal({
|
||||
"ResourceType": "instance",
|
||||
"Tags": [
|
||||
{"Key": "key", "Value": "value"}
|
||||
]
|
||||
})
|
||||
1861
tests/test_iam/test_iam_policies.py
Normal file
1861
tests/test_iam/test_iam_policies.py
Normal file
File diff suppressed because it is too large
Load diff
114
tests/test_ses/test_ses_sns_boto3.py
Normal file
114
tests/test_ses/test_ses_sns_boto3.py
Normal file
|
|
@ -0,0 +1,114 @@
|
|||
from __future__ import unicode_literals
|
||||
|
||||
import boto3
|
||||
import json
|
||||
from botocore.exceptions import ClientError
|
||||
from six.moves.email_mime_multipart import MIMEMultipart
|
||||
from six.moves.email_mime_text import MIMEText
|
||||
|
||||
import sure # noqa
|
||||
from nose import tools
|
||||
from moto import mock_ses, mock_sns, mock_sqs
|
||||
from moto.ses.models import SESFeedback
|
||||
|
||||
|
||||
@mock_ses
|
||||
def test_enable_disable_ses_sns_communication():
|
||||
conn = boto3.client('ses', region_name='us-east-1')
|
||||
conn.set_identity_notification_topic(
|
||||
Identity='test.com',
|
||||
NotificationType='Bounce',
|
||||
SnsTopic='the-arn'
|
||||
)
|
||||
conn.set_identity_notification_topic(
|
||||
Identity='test.com',
|
||||
NotificationType='Bounce'
|
||||
)
|
||||
|
||||
|
||||
def __setup_feedback_env__(ses_conn, sns_conn, sqs_conn, domain, topic, queue, region, expected_msg):
|
||||
"""Setup the AWS environment to test the SES SNS Feedback"""
|
||||
# Environment setup
|
||||
# Create SQS queue
|
||||
sqs_conn.create_queue(QueueName=queue)
|
||||
# Create SNS topic
|
||||
create_topic_response = sns_conn.create_topic(Name=topic)
|
||||
topic_arn = create_topic_response["TopicArn"]
|
||||
# Subscribe the SNS topic to the SQS queue
|
||||
sns_conn.subscribe(TopicArn=topic_arn,
|
||||
Protocol="sqs",
|
||||
Endpoint="arn:aws:sqs:%s:123456789012:%s" % (region, queue))
|
||||
# Verify SES domain
|
||||
ses_conn.verify_domain_identity(Domain=domain)
|
||||
# Setup SES notification topic
|
||||
if expected_msg is not None:
|
||||
ses_conn.set_identity_notification_topic(
|
||||
Identity=domain,
|
||||
NotificationType=expected_msg,
|
||||
SnsTopic=topic_arn
|
||||
)
|
||||
|
||||
|
||||
def __test_sns_feedback__(addr, expected_msg):
|
||||
region_name = "us-east-1"
|
||||
ses_conn = boto3.client('ses', region_name=region_name)
|
||||
sns_conn = boto3.client('sns', region_name=region_name)
|
||||
sqs_conn = boto3.resource('sqs', region_name=region_name)
|
||||
domain = "example.com"
|
||||
topic = "bounce-arn-feedback"
|
||||
queue = "feedback-test-queue"
|
||||
|
||||
__setup_feedback_env__(ses_conn, sns_conn, sqs_conn, domain, topic, queue, region_name, expected_msg)
|
||||
|
||||
# Send the message
|
||||
kwargs = dict(
|
||||
Source="test@" + domain,
|
||||
Destination={
|
||||
"ToAddresses": [addr + "@" + domain],
|
||||
"CcAddresses": ["test_cc@" + domain],
|
||||
"BccAddresses": ["test_bcc@" + domain],
|
||||
},
|
||||
Message={
|
||||
"Subject": {"Data": "test subject"},
|
||||
"Body": {"Text": {"Data": "test body"}}
|
||||
}
|
||||
)
|
||||
ses_conn.send_email(**kwargs)
|
||||
|
||||
# Wait for messages in the queues
|
||||
queue = sqs_conn.get_queue_by_name(QueueName=queue)
|
||||
messages = queue.receive_messages(MaxNumberOfMessages=1)
|
||||
if expected_msg is not None:
|
||||
msg = messages[0].body
|
||||
msg = json.loads(msg)
|
||||
assert msg["Message"] == SESFeedback.generate_message(expected_msg)
|
||||
else:
|
||||
assert len(messages) == 0
|
||||
|
||||
|
||||
@mock_sqs
|
||||
@mock_sns
|
||||
@mock_ses
|
||||
def test_no_sns_feedback():
|
||||
__test_sns_feedback__("test", None)
|
||||
|
||||
|
||||
@mock_sqs
|
||||
@mock_sns
|
||||
@mock_ses
|
||||
def test_sns_feedback_bounce():
|
||||
__test_sns_feedback__(SESFeedback.BOUNCE_ADDR, SESFeedback.BOUNCE)
|
||||
|
||||
|
||||
@mock_sqs
|
||||
@mock_sns
|
||||
@mock_ses
|
||||
def test_sns_feedback_complaint():
|
||||
__test_sns_feedback__(SESFeedback.COMPLAINT_ADDR, SESFeedback.COMPLAINT)
|
||||
|
||||
|
||||
@mock_sqs
|
||||
@mock_sns
|
||||
@mock_ses
|
||||
def test_sns_feedback_delivery():
|
||||
__test_sns_feedback__(SESFeedback.SUCCESS_ADDR, SESFeedback.DELIVERY)
|
||||
Loading…
Add table
Add a link
Reference in a new issue