| 1 | # Plan-time tests for the scanning grant. mock_provider means no AWS account |
| 2 | # and no credentials: these assert what the module WOULD create. |
| 3 | mock_provider "aws" {} |
| 4 | |
| 5 | override_data { |
| 6 | target = data.aws_vpcs.default |
| 7 | values = { ids = ["vpc-0aaaaaaaaaaaaaaaa"] } |
| 8 | } |
| 9 | |
| 10 | # The termination queue's ARN feeds an EventBridge target, which the provider |
| 11 | # validates as an ARN; the mock's random string is not one. |
| 12 | override_resource { |
| 13 | target = aws_sqs_queue.terminations |
| 14 | values = { arn = "arn:aws:sqs:eu-west-1:123456789012:carlos-test-host-terminations" } |
| 15 | } |
| 16 | |
| 17 | variables { |
| 18 | name = "carlos-test-ie" |
| 19 | sg_description = "carlos test host" |
| 20 | iam_name = "carlos-test-host" |
| 21 | instance_type = "t4g.small" |
| 22 | root_volume_size = 20 |
| 23 | user_data = "#!/bin/sh\n" |
| 24 | deployment_bucket_arn = "arn:aws:s3:::carlos-test-platform" |
| 25 | data_bucket_arn = "arn:aws:s3:::carlos-test-ie" |
| 26 | ssm_parameter_arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/carlos/*" |
| 27 | store_bucket_prefix = "carlos-store-test-" |
| 28 | } |
| 29 | |
| 30 | run "off_by_default" { |
| 31 | command = plan |
| 32 | assert { |
| 33 | condition = length(aws_iam_role_policy.host_store_scan) == 0 |
| 34 | error_message = "store_scanning defaults to false and must create nothing" |
| 35 | } |
| 36 | } |
| 37 | |
| 38 | run "on_grants_exactly_read_and_tag" { |
| 39 | command = plan |
| 40 | variables { |
| 41 | store_scanning = true |
| 42 | } |
| 43 | assert { |
| 44 | condition = length(aws_iam_role_policy.host_store_scan) == 1 |
| 45 | error_message = "store_scanning = true must create the scan policy" |
| 46 | } |
| 47 | assert { |
| 48 | condition = aws_iam_role_policy.host_store_scan[0].name == "carlos-test-host-store-scan" |
| 49 | error_message = "the policy is named <iam_name>-store-scan" |
| 50 | } |
| 51 | assert { |
| 52 | condition = toset(jsondecode(aws_iam_role_policy.host_store_scan[0].policy).Statement[0].Action) == toset([ |
| 53 | "s3:GetObject", "s3:GetObjectTagging", "s3:PutObjectTagging", |
| 54 | ]) |
| 55 | error_message = "exactly the three actions the scanner calls, no more" |
| 56 | } |
| 57 | assert { |
| 58 | condition = jsondecode(aws_iam_role_policy.host_store_scan[0].policy).Statement[0].Resource == "arn:aws:s3:::carlos-store-test-*/*" |
| 59 | error_message = "scoped to objects under the store prefix" |
| 60 | } |
| 61 | } |
| 62 | |
| 63 | run "refused_without_a_store_prefix" { |
| 64 | command = plan |
| 65 | variables { |
| 66 | store_scanning = true |
| 67 | store_bucket_prefix = "" |
| 68 | } |
| 69 | expect_failures = [aws_iam_role_policy.host_store_scan] |
| 70 | } |
| 71 | |
amadan