| 1 | # Plan-time tests for the console mail grant. mock_provider means no AWS account |
| 2 | # and no credentials: these assert what the module WOULD create. |
| 3 | mock_provider "aws" {} |
| 4 | |
| 5 | override_data { |
| 6 | target = data.aws_vpcs.default |
| 7 | values = { ids = ["vpc-0aaaaaaaaaaaaaaaa"] } |
| 8 | } |
| 9 | |
| 10 | override_data { |
| 11 | target = data.aws_caller_identity.current |
| 12 | values = { account_id = "123456789012" } |
| 13 | } |
| 14 | |
| 15 | # The termination queue's ARN feeds an EventBridge target, which the provider |
| 16 | # validates as an ARN; the mock's random string is not one. |
| 17 | override_resource { |
| 18 | target = aws_sqs_queue.terminations |
| 19 | values = { arn = "arn:aws:sqs:eu-west-1:123456789012:carlos-test-host-terminations" } |
| 20 | } |
| 21 | |
| 22 | variables { |
| 23 | name = "carlos-test-ie" |
| 24 | sg_description = "carlos test host" |
| 25 | iam_name = "carlos-test-host" |
| 26 | instance_type = "t4g.small" |
| 27 | root_volume_size = 20 |
| 28 | user_data = "#!/bin/sh\n" |
| 29 | deployment_bucket_arn = "arn:aws:s3:::carlos-test-platform" |
| 30 | data_bucket_arn = "arn:aws:s3:::carlos-test-ie" |
| 31 | ssm_parameter_arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/carlos/*" |
| 32 | } |
| 33 | |
| 34 | run "off_by_default" { |
| 35 | command = plan |
| 36 | assert { |
| 37 | condition = length(aws_iam_role_policy.host_console_mail) == 0 |
| 38 | error_message = "console_mail_from empty must create no policy" |
| 39 | } |
| 40 | } |
| 41 | |
| 42 | run "from_and_region_set_creates_policy" { |
| 43 | command = plan |
| 44 | variables { |
| 45 | console_mail_from = "noreply@console-mail.bab.example.com" |
| 46 | console_mail_region = "eu-west-1" |
| 47 | } |
| 48 | assert { |
| 49 | condition = length(aws_iam_role_policy.host_console_mail) == 1 |
| 50 | error_message = "From + region set must create one policy" |
| 51 | } |
| 52 | assert { |
| 53 | condition = aws_iam_role_policy.host_console_mail[0].name == "carlos-test-host-console-mail" |
| 54 | error_message = "the policy is named <iam_name>-console-mail" |
| 55 | } |
| 56 | assert { |
| 57 | condition = toset(jsondecode(aws_iam_role_policy.host_console_mail[0].policy).Statement[0].Action) == toset([ |
| 58 | "ses:SendEmail", |
| 59 | ]) |
| 60 | error_message = "the only action is ses:SendEmail" |
| 61 | } |
| 62 | assert { |
| 63 | condition = contains( |
| 64 | jsondecode(aws_iam_role_policy.host_console_mail[0].policy).Statement[0].Resource, |
| 65 | "arn:aws:ses:eu-west-1:123456789012:identity/console-mail.bab.example.com" |
| 66 | ) |
| 67 | error_message = "must contain identity ARN with domain extracted from From address" |
| 68 | } |
| 69 | assert { |
| 70 | condition = contains( |
| 71 | jsondecode(aws_iam_role_policy.host_console_mail[0].policy).Statement[0].Resource, |
| 72 | "arn:aws:ses:eu-west-1:123456789012:configuration-set/carlos-bab" |
| 73 | ) |
| 74 | error_message = "must contain configuration-set/carlos-bab ARN" |
| 75 | } |
| 76 | assert { |
| 77 | condition = contains( |
| 78 | jsondecode(aws_iam_role_policy.host_console_mail[0].policy).Statement[0].Resource, |
| 79 | "arn:aws:ses:eu-west-1:123456789012:tenant/carlos-bab/*" |
| 80 | ) |
| 81 | error_message = "must contain tenant/carlos-bab/* ARN" |
| 82 | } |
| 83 | assert { |
| 84 | condition = jsondecode(aws_iam_role_policy.host_console_mail[0].policy).Statement[0].Condition.StringEquals["ses:FromAddress"] == "noreply@console-mail.bab.example.com" |
| 85 | error_message = "must have ses:FromAddress condition matching the From address" |
| 86 | } |
| 87 | } |
| 88 | |
| 89 | run "from_set_without_region_fails_precondition" { |
| 90 | command = plan |
| 91 | variables { |
| 92 | console_mail_from = "noreply@console-mail.bab.example.com" |
| 93 | console_mail_region = "" |
| 94 | } |
| 95 | expect_failures = [aws_iam_role_policy.host_console_mail] |
| 96 | } |
| 97 | |
| 98 | run "uppercase_from_fails_validation" { |
| 99 | command = plan |
| 100 | variables { |
| 101 | console_mail_from = "noreply@console-mail.bab.EXAMPLE.COM" |
| 102 | console_mail_region = "eu-west-1" |
| 103 | } |
| 104 | expect_failures = [var.console_mail_from] |
| 105 | } |
| 106 | |
amadan