carlos / platform Public

Download this file

1	mock_provider "aws" {}
2
3	override_resource {
4	target = aws_s3_bucket.deployment
5	values = { arn = "arn:aws:s3:::dep" }
6	}
7
8	variables {
9	deployment_bucket_name = "dep"
10	data_bucket_name = "data"
11	}
12
13	run "only_exact_box_roles_create_fences" {
14	command = plan
15	variables {
16	box_fence_writer_role_arns = ["arn:aws:iam::123456789012:role/box-worker"]
17	}
18	assert {
19	condition = jsonencode([
20	for s in jsondecode(aws_s3_bucket_policy.deployment_box_records.policy).Statement : s if s.Sid == "OnlyBoxRolesWriteTerminationFences"
21	]) == jsonencode([{
22	Sid = "OnlyBoxRolesWriteTerminationFences"
23	Effect = "Deny"
24	Principal = "*"
25	Action = "s3:PutObject"
26	Resource = "arn:aws:s3:::dep/control/box-fences/*"
27	Condition = { ArnNotEquals = { "aws:PrincipalArn" = ["arn:aws:iam::123456789012:role/box-worker"] } }
28	}])
29	error_message = "Only exact approved box roles may create termination fences."
30	}
31	}
32
33	run "empty_box_role_inventory_denies_everyone" {
34	command = plan
35	assert {
36	condition = jsonencode([
37	for s in jsondecode(aws_s3_bucket_policy.deployment_box_records.policy).Statement : s.Condition.ArnNotEquals["aws:PrincipalArn"] if s.Sid == "OnlyBoxRolesWriteTerminationFences"
38	]) == jsonencode([["arn:aws:iam::000000000000:role/nobody"]])
39	error_message = "An empty box-role inventory must grant no fence writer."
40	}
41	}
42
43	run "wildcard_writer_roles_are_refused" {
44	command = plan
45	variables {
46	box_fence_writer_role_arns = ["arn:aws:iam::123456789012:role/*"]
47	}
48	expect_failures = [var.box_fence_writer_role_arns]
49	}
50