Skip to content

Commit d4845ce

Browse files
rix0rrrmergify[bot]
rix0rrr
and
mergify[bot]
authored
chore: make tests work with new SDKv3 version (#33016)
In a recent upgrade of the SDKv3, the INI credential provider has gotten a private copy of the STS Client, to make AssumeRole calls with. This means the STS Client used by the INI provider is now unmockable. In #31702, we migrated the tests of the credentials chain mostly to using mocks, as opposed to what it was doing in the past: intercepting network traffic and emulating a fake STS Endpoint. These tests now start failing due to an SDK upgrade. Fortunately, most of the old code was still there, so in this change I'm ripping out the STS Mocking and doing a couple minor changes; the tests now pass again. This PR also upgrades the SDKv3 version at the same time, some other packages that needed to be upgraded along with this as well (`@smithy/middleware-endpoint` and `cdk-assets` which covers a new enum value for the S3 client). ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license* --------- Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
1 parent c9d4a67 commit d4845ce

File tree

6 files changed

+2253
-14143
lines changed

6 files changed

+2253
-14143
lines changed

‎packages/aws-cdk/THIRD_PARTY_LICENSES‎

Lines changed: 224 additions & 14000 deletions
Large diffs are not rendered by default.

‎packages/aws-cdk/package.json‎

Lines changed: 29 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -108,38 +108,38 @@
108108
"@aws-cdk/cloudformation-diff": "0.0.0",
109109
"@aws-cdk/cx-api": "0.0.0",
110110
"@aws-cdk/region-info": "0.0.0",
111-
"@aws-sdk/client-appsync": "3.699.0",
112-
"@aws-sdk/client-cloudformation": "3.699.0",
113-
"@aws-sdk/client-cloudwatch-logs": "3.699.0",
114-
"@aws-sdk/client-codebuild": "3.699.0",
115-
"@aws-sdk/client-ec2": "3.699.0",
116-
"@aws-sdk/client-ecr": "3.699.0",
117-
"@aws-sdk/client-ecs": "3.699.0",
118-
"@aws-sdk/client-elastic-load-balancing-v2": "3.699.0",
119-
"@aws-sdk/client-iam": "3.699.0",
120-
"@aws-sdk/client-kms": "3.699.0",
121-
"@aws-sdk/client-lambda": "3.699.0",
122-
"@aws-sdk/client-route-53": "3.699.0",
123-
"@aws-sdk/client-s3": "3.699.0",
124-
"@aws-sdk/client-secrets-manager": "3.699.0",
125-
"@aws-sdk/client-sfn": "3.699.0",
126-
"@aws-sdk/client-ssm": "3.699.0",
127-
"@aws-sdk/client-sts": "3.699.0",
128-
"@aws-sdk/credential-providers": "3.699.0",
129-
"@aws-sdk/ec2-metadata-service": "3.699.0",
130-
"@aws-sdk/lib-storage": "3.699.0",
111+
"@aws-sdk/client-appsync": "^3.699.0",
112+
"@aws-sdk/client-cloudformation": "^3.699.0",
113+
"@aws-sdk/client-cloudwatch-logs": "^3.699.0",
114+
"@aws-sdk/client-codebuild": "^3.699.0",
115+
"@aws-sdk/client-ec2": "^3.699.0",
116+
"@aws-sdk/client-ecr": "^3.699.0",
117+
"@aws-sdk/client-ecs": "^3.699.0",
118+
"@aws-sdk/client-elastic-load-balancing-v2": "^3.699.0",
119+
"@aws-sdk/client-iam": "^3.699.0",
120+
"@aws-sdk/client-kms": "^3.699.0",
121+
"@aws-sdk/client-lambda": "^3.699.0",
122+
"@aws-sdk/client-route-53": "^3.699.0",
123+
"@aws-sdk/client-s3": "^3.699.0",
124+
"@aws-sdk/client-secrets-manager": "^3.699.0",
125+
"@aws-sdk/client-sfn": "^3.699.0",
126+
"@aws-sdk/client-ssm": "^3.699.0",
127+
"@aws-sdk/client-sts": "^3.699.0",
128+
"@aws-sdk/credential-providers": "^3.699.0",
129+
"@aws-sdk/ec2-metadata-service": "^3.699.0",
130+
"@aws-sdk/lib-storage": "^3.699.0",
131131
"@jsii/check-node": "1.104.0",
132-
"@smithy/middleware-endpoint": "3.1.4",
133-
"@smithy/node-http-handler": "3.2.4",
134-
"@smithy/property-provider": "3.1.10",
135-
"@smithy/shared-ini-file-loader": "3.1.8",
136-
"@smithy/types": "3.5.0",
137-
"@smithy/util-retry": "3.0.7",
138-
"@smithy/util-stream": "3.1.9",
139-
"@smithy/util-waiter": "3.1.6",
132+
"@smithy/middleware-endpoint": "^4",
133+
"@smithy/node-http-handler": "^3.2.4",
134+
"@smithy/property-provider": "^3.1.10",
135+
"@smithy/shared-ini-file-loader": "^3.1.8",
136+
"@smithy/types": "^3.5.0",
137+
"@smithy/util-retry": "^3.0.7",
138+
"@smithy/util-stream": "^3.1.9",
139+
"@smithy/util-waiter": "^3.1.6",
140140
"archiver": "^5.3.2",
141141
"camelcase": "^6.3.0",
142-
"cdk-assets": "^3.0.0-rc.111",
142+
"cdk-assets": "^3.0.0-rc.123",
143143
"cdk-from-cfn": "^0.162.0",
144144
"chalk": "^4",
145145
"chokidar": "^3.6.0",

‎packages/aws-cdk/test/api/fake-sts.ts‎

Lines changed: 33 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,8 @@
1-
import { AssumeRoleCommand, GetCallerIdentityCommand, Tag } from '@aws-sdk/client-sts';
1+
import { Tag } from '@aws-sdk/client-sts';
22
import * as nock from 'nock';
33
import * as uuid from 'uuid';
44
import * as xmlJs from 'xml-js';
55
import { formatErrorMessage } from '../../lib/util/error';
6-
import { mockSTSClient } from '../util/mock-sdk';
76

87
interface RegisteredIdentity {
98
readonly account: string;
@@ -21,6 +20,7 @@ interface RegisteredRole {
2120
interface AssumedRole {
2221
readonly roleArn: string;
2322
readonly serialNumber: string;
23+
readonly externalId?: string;
2424
readonly tokenCode: string;
2525
readonly roleSessionName: string;
2626
readonly tags?: Tag[];
@@ -43,10 +43,22 @@ interface AssumedRole {
4343
export class FakeSts {
4444
public readonly assumedRoles = new Array<AssumedRole>();
4545

46+
/**
47+
* AccessKey -> User or Session
48+
*/
4649
private identities: Record<string, RegisteredIdentity> = {};
50+
51+
/**
52+
* RoleARN -> Role
53+
*
54+
* When a Role is assumed it creates a Session.
55+
*/
4756
private roles: Record<string, RegisteredRole> = {};
4857

49-
constructor() {}
58+
/**
59+
* Throw this error when AssumeRole is called
60+
*/
61+
public failAssumeRole?: Error;
5062

5163
/**
5264
* Begin mocking
@@ -71,7 +83,8 @@ export class FakeSts {
7183
parsedBody,
7284
headers: this.req.headers,
7385
});
74-
cb(null, [200, xmlJs.js2xml(response, { compact: true })]);
86+
const xml = xmlJs.js2xml(response, { compact: true });
87+
cb(null, [200, xml]);
7588
} catch (e: any) {
7689
cb(null, [
7790
400,
@@ -111,6 +124,13 @@ export class FakeSts {
111124
nock.enableNetConnect();
112125
}
113126

127+
public printState() {
128+
// eslint-disable-next-line no-console
129+
console.log(this.roles);
130+
// eslint-disable-next-line no-console
131+
console.log(this.identities);
132+
}
133+
114134
/**
115135
* Register a user
116136
*/
@@ -124,8 +144,6 @@ export class FakeSts {
124144
arn,
125145
userId,
126146
};
127-
128-
this.setSTSMocks(account, arn, userName, accessKey);
129147
}
130148

131149
/**
@@ -140,44 +158,17 @@ export class FakeSts {
140158
roleName,
141159
account,
142160
};
143-
144-
this.setSTSMocks(account, roleArn, roleArn);
145-
}
146-
147-
private setSTSMocks(account: string, roleArn: string, name: string, accessKey?: string) {
148-
const accessKeyId = accessKey ?? uuid.v4();
149-
mockSTSClient
150-
.on(GetCallerIdentityCommand)
151-
.resolves({
152-
Account: account,
153-
Arn: roleArn,
154-
UserId: name,
155-
})
156-
.on(AssumeRoleCommand)
157-
.resolves({
158-
AssumedRoleUser: {
159-
Arn: roleArn,
160-
AssumedRoleId: `${accessKeyId}:${name}`,
161-
},
162-
Credentials: {
163-
AccessKeyId: accessKeyId,
164-
SecretAccessKey: 'Secret',
165-
SessionToken: 'Token',
166-
Expiration: new Date(Date.now() + 3600 * 1000),
167-
},
168-
PackedPolicySize: 6,
169-
});
170161
}
171162

172163
private handleRequest(mockRequest: MockRequest): Record<string, any> {
173164
const response = (() => {
174165
const identity = this.identity(mockRequest);
175166

176167
switch (mockRequest.parsedBody.Action) {
177-
case 'GetCallerIdentityCommand':
168+
case 'GetCallerIdentity':
178169
return this.handleGetCallerIdentity(identity);
179170

180-
case 'AssumeRoleCommand':
171+
case 'AssumeRole':
181172
return this.handleAssumeRole(identity, mockRequest);
182173
}
183174

@@ -229,6 +220,9 @@ export class FakeSts {
229220

230221
private handleAssumeRole(identity: RegisteredIdentity, mockRequest: MockRequest): Record<string, any> {
231222
this.checkForFailure(mockRequest.parsedBody.RoleArn);
223+
if (this.failAssumeRole) {
224+
throw this.failAssumeRole;
225+
}
232226

233227
this.assumedRoles.push({
234228
roleArn: mockRequest.parsedBody.RoleArn,
@@ -237,6 +231,7 @@ export class FakeSts {
237231
tokenCode: mockRequest.parsedBody.TokenCode,
238232
tags: this.decodeMapFromRequestBody('Tags', mockRequest.parsedBody),
239233
transitiveTagKeys: this.decodeListKeysFromRequestBody('TransitiveTagKeys', mockRequest.parsedBody),
234+
externalId: mockRequest.parsedBody.ExternalId,
240235
});
241236

242237
const roleArn = mockRequest.parsedBody.RoleArn;
@@ -274,9 +269,9 @@ export class FakeSts {
274269
},
275270
PackedPolicySize: 6,
276271
},
277-
},
278-
ResponseMetadata: {
279-
RequestId: '1',
272+
ResponseMetadata: {
273+
RequestId: '1',
274+
},
280275
},
281276
};
282277
}

0 commit comments

Comments
 (0)