Skip to content

Commit 029e6a1

Browse files
dvasilasdvasilas
committed
LOGC-57: Extract createIAMUser helper to reduce e2e test duplication
1 parent 67d027d commit 029e6a1

3 files changed

Lines changed: 88 additions & 170 deletions

File tree

‎test/e2e/acl_required_test.go‎

Lines changed: 6 additions & 121 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,9 @@ import (
44
"bytes"
55
"context"
66
"fmt"
7-
"os"
87
"time"
98

109
"github.com/aws/aws-sdk-go-v2/aws"
11-
"github.com/aws/aws-sdk-go-v2/service/iam"
1210
"github.com/aws/aws-sdk-go-v2/service/s3"
1311
. "github.com/onsi/ginkgo/v2"
1412
. "github.com/onsi/gomega"
@@ -66,43 +64,7 @@ var _ = Describe("aclRequired field in access logs", func() {
6664
Expect(err).NotTo(HaveOccurred(), "PUT should succeed")
6765

6866
// Create IAM user with s3:GetObject permission
69-
iamEndpoint := os.Getenv("E2E_IAM_ENDPOINT")
70-
if iamEndpoint == "" {
71-
iamEndpoint = testIAMEndpoint
72-
}
73-
accessKey := os.Getenv("E2E_S3_ACCESS_KEY_ID")
74-
if accessKey == "" {
75-
accessKey = testAccessKeyID
76-
}
77-
secretKey := os.Getenv("E2E_S3_SECRET_ACCESS_KEY")
78-
if secretKey == "" {
79-
secretKey = testSecretAccessKey
80-
}
81-
82-
iamClient := iam.NewFromConfig(aws.Config{
83-
Region: testRegion,
84-
Credentials: aws.CredentialsProviderFunc(func(ctx context.Context) (aws.Credentials, error) {
85-
return aws.Credentials{
86-
AccessKeyID: accessKey,
87-
SecretAccessKey: secretKey,
88-
}, nil
89-
}),
90-
}, func(o *iam.Options) {
91-
o.BaseEndpoint = aws.String(iamEndpoint)
92-
})
93-
9467
userName := fmt.Sprintf("e2e-acl-test-%d", time.Now().UnixNano())
95-
_, err = iamClient.CreateUser(ctx, &iam.CreateUserInput{
96-
UserName: aws.String(userName),
97-
})
98-
Expect(err).NotTo(HaveOccurred(), "CreateUser should succeed")
99-
100-
createKeyResp, err := iamClient.CreateAccessKey(ctx, &iam.CreateAccessKeyInput{
101-
UserName: aws.String(userName),
102-
})
103-
Expect(err).NotTo(HaveOccurred(), "CreateAccessKey should succeed")
104-
105-
// Attach inline policy allowing s3:GetObject on the source bucket
10668
policy := fmt.Sprintf(`{
10769
"Version": "2012-10-17",
10870
"Statement": [{
@@ -111,32 +73,11 @@ var _ = Describe("aclRequired field in access logs", func() {
11173
"Resource": "arn:aws:s3:::%s/*"
11274
}]
11375
}`, testCtx.SourceBucket)
114-
_, err = iamClient.PutUserPolicy(ctx, &iam.PutUserPolicyInput{
115-
UserName: aws.String(userName),
116-
PolicyName: aws.String("allow-get-object"),
117-
PolicyDocument: aws.String(policy),
118-
})
119-
Expect(err).NotTo(HaveOccurred(), "PutUserPolicy should succeed")
120-
121-
defer func() {
122-
_, _ = iamClient.DeleteUserPolicy(ctx, &iam.DeleteUserPolicyInput{
123-
UserName: aws.String(userName),
124-
PolicyName: aws.String("allow-get-object"),
125-
})
126-
_, _ = iamClient.DeleteAccessKey(ctx, &iam.DeleteAccessKeyInput{
127-
UserName: aws.String(userName),
128-
AccessKeyId: createKeyResp.AccessKey.AccessKeyId,
129-
})
130-
_, _ = iamClient.DeleteUser(ctx, &iam.DeleteUserInput{
131-
UserName: aws.String(userName),
132-
})
133-
}()
76+
iamUser := createIAMUser(ctx, userName, "allow-get-object", policy)
77+
defer iamUser.Cleanup()
13478

13579
// GET object as the IAM user — authorized via ACL (same account)
136-
iamS3Client := newS3ClientWithCredentials(
137-
*createKeyResp.AccessKey.AccessKeyId,
138-
*createKeyResp.AccessKey.SecretAccessKey,
139-
)
80+
iamS3Client := iamUser.S3Client
14081

14182
_, err = iamS3Client.GetObject(ctx, &s3.GetObjectInput{
14283
Bucket: aws.String(testCtx.SourceBucket),
@@ -173,42 +114,7 @@ var _ = Describe("aclRequired field in access logs", func() {
173114
Expect(err).NotTo(HaveOccurred(), "PUT should succeed")
174115

175116
// Create IAM user with GetObject + PutObject permissions for the copy
176-
iamEndpoint := os.Getenv("E2E_IAM_ENDPOINT")
177-
if iamEndpoint == "" {
178-
iamEndpoint = testIAMEndpoint
179-
}
180-
accessKey := os.Getenv("E2E_S3_ACCESS_KEY_ID")
181-
if accessKey == "" {
182-
accessKey = testAccessKeyID
183-
}
184-
secretKey := os.Getenv("E2E_S3_SECRET_ACCESS_KEY")
185-
if secretKey == "" {
186-
secretKey = testSecretAccessKey
187-
}
188-
189-
iamClient := iam.NewFromConfig(aws.Config{
190-
Region: testRegion,
191-
Credentials: aws.CredentialsProviderFunc(func(ctx context.Context) (aws.Credentials, error) {
192-
return aws.Credentials{
193-
AccessKeyID: accessKey,
194-
SecretAccessKey: secretKey,
195-
}, nil
196-
}),
197-
}, func(o *iam.Options) {
198-
o.BaseEndpoint = aws.String(iamEndpoint)
199-
})
200-
201117
userName := fmt.Sprintf("e2e-acl-copy-%d", time.Now().UnixNano())
202-
_, err = iamClient.CreateUser(ctx, &iam.CreateUserInput{
203-
UserName: aws.String(userName),
204-
})
205-
Expect(err).NotTo(HaveOccurred(), "CreateUser should succeed")
206-
207-
createKeyResp, err := iamClient.CreateAccessKey(ctx, &iam.CreateAccessKeyInput{
208-
UserName: aws.String(userName),
209-
})
210-
Expect(err).NotTo(HaveOccurred(), "CreateAccessKey should succeed")
211-
212118
policy := fmt.Sprintf(`{
213119
"Version": "2012-10-17",
214120
"Statement": [{
@@ -217,32 +123,11 @@ var _ = Describe("aclRequired field in access logs", func() {
217123
"Resource": "arn:aws:s3:::%s/*"
218124
}]
219125
}`, testCtx.SourceBucket)
220-
_, err = iamClient.PutUserPolicy(ctx, &iam.PutUserPolicyInput{
221-
UserName: aws.String(userName),
222-
PolicyName: aws.String("allow-copy"),
223-
PolicyDocument: aws.String(policy),
224-
})
225-
Expect(err).NotTo(HaveOccurred(), "PutUserPolicy should succeed")
226-
227-
defer func() {
228-
_, _ = iamClient.DeleteUserPolicy(ctx, &iam.DeleteUserPolicyInput{
229-
UserName: aws.String(userName),
230-
PolicyName: aws.String("allow-copy"),
231-
})
232-
_, _ = iamClient.DeleteAccessKey(ctx, &iam.DeleteAccessKeyInput{
233-
UserName: aws.String(userName),
234-
AccessKeyId: createKeyResp.AccessKey.AccessKeyId,
235-
})
236-
_, _ = iamClient.DeleteUser(ctx, &iam.DeleteUserInput{
237-
UserName: aws.String(userName),
238-
})
239-
}()
126+
iamUser := createIAMUser(ctx, userName, "allow-copy", policy)
127+
defer iamUser.Cleanup()
240128

241129
// Copy as IAM user — both source GET and destination PUT go through ACL path
242-
iamS3Client := newS3ClientWithCredentials(
243-
*createKeyResp.AccessKey.AccessKeyId,
244-
*createKeyResp.AccessKey.SecretAccessKey,
245-
)
130+
iamS3Client := iamUser.S3Client
246131

247132
_, err = iamS3Client.CopyObject(ctx, &s3.CopyObjectInput{
248133
Bucket: aws.String(testCtx.SourceBucket),

‎test/e2e/error_cases_test.go‎

Lines changed: 3 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ import (
88
"time"
99

1010
"github.com/aws/aws-sdk-go-v2/aws"
11-
"github.com/aws/aws-sdk-go-v2/service/iam"
1211
"github.com/aws/aws-sdk-go-v2/service/s3"
1312
. "github.com/onsi/ginkgo/v2"
1413
. "github.com/onsi/gomega"
@@ -183,56 +182,11 @@ var _ = Describe("Error Cases", func() {
183182
time.Sleep(1 * time.Second)
184183

185184
// Create IAM user with no permissions
186-
iamEndpoint := os.Getenv("E2E_IAM_ENDPOINT")
187-
if iamEndpoint == "" {
188-
iamEndpoint = testIAMEndpoint
189-
}
190-
accessKey := os.Getenv("E2E_S3_ACCESS_KEY_ID")
191-
if accessKey == "" {
192-
accessKey = testAccessKeyID
193-
}
194-
secretKey := os.Getenv("E2E_S3_SECRET_ACCESS_KEY")
195-
if secretKey == "" {
196-
secretKey = testSecretAccessKey
197-
}
198-
199-
iamClient := iam.NewFromConfig(aws.Config{
200-
Region: testRegion,
201-
Credentials: aws.CredentialsProviderFunc(func(ctx context.Context) (aws.Credentials, error) {
202-
return aws.Credentials{
203-
AccessKeyID: accessKey,
204-
SecretAccessKey: secretKey,
205-
}, nil
206-
}),
207-
}, func(o *iam.Options) {
208-
o.BaseEndpoint = aws.String(iamEndpoint)
209-
})
210-
211185
userName := fmt.Sprintf("e2e-test-user-%d", time.Now().UnixNano())
212-
_, err = iamClient.CreateUser(ctx, &iam.CreateUserInput{
213-
UserName: aws.String(userName),
214-
})
215-
Expect(err).NotTo(HaveOccurred(), "CreateUser should succeed")
186+
iamUser := createIAMUser(ctx, userName, "", "")
187+
defer iamUser.Cleanup()
216188

217-
createKeyResp, err := iamClient.CreateAccessKey(ctx, &iam.CreateAccessKeyInput{
218-
UserName: aws.String(userName),
219-
})
220-
Expect(err).NotTo(HaveOccurred(), "CreateAccessKey should succeed")
221-
222-
defer func() {
223-
_, _ = iamClient.DeleteAccessKey(ctx, &iam.DeleteAccessKeyInput{
224-
UserName: aws.String(userName),
225-
AccessKeyId: createKeyResp.AccessKey.AccessKeyId,
226-
})
227-
_, _ = iamClient.DeleteUser(ctx, &iam.DeleteUserInput{
228-
UserName: aws.String(userName),
229-
})
230-
}()
231-
232-
unprivilegedClient := newS3ClientWithCredentials(
233-
*createKeyResp.AccessKey.AccessKeyId,
234-
*createKeyResp.AccessKey.SecretAccessKey,
235-
)
189+
unprivilegedClient := iamUser.S3Client
236190

237191
_, err = unprivilegedClient.GetObject(ctx, &s3.GetObjectInput{
238192
Bucket: aws.String(testCtx.SourceBucket),

‎test/e2e/helpers_test.go‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ import (
1313
"time"
1414

1515
"github.com/aws/aws-sdk-go-v2/aws"
16+
"github.com/aws/aws-sdk-go-v2/service/iam"
1617
"github.com/aws/aws-sdk-go-v2/service/s3"
1718
"github.com/aws/aws-sdk-go-v2/service/s3/types"
1819
. "github.com/onsi/ginkgo/v2"
@@ -658,6 +659,84 @@ func newS3ClientWithCredentials(accessKeyID, secretAccessKey string) *s3.Client
658659
})
659660
}
660661

662+
type IAMUserResult struct {
663+
S3Client *s3.Client
664+
Cleanup func()
665+
}
666+
667+
// createIAMUser creates an IAM user with an optional inline policy.
668+
// If policyName and policyDocument are non-empty, the policy is attached.
669+
func createIAMUser(ctx context.Context, userName, policyName, policyDocument string) IAMUserResult {
670+
GinkgoHelper()
671+
672+
iamEndpoint := os.Getenv("E2E_IAM_ENDPOINT")
673+
if iamEndpoint == "" {
674+
iamEndpoint = testIAMEndpoint
675+
}
676+
accessKey := os.Getenv("E2E_S3_ACCESS_KEY_ID")
677+
if accessKey == "" {
678+
accessKey = testAccessKeyID
679+
}
680+
secretKey := os.Getenv("E2E_S3_SECRET_ACCESS_KEY")
681+
if secretKey == "" {
682+
secretKey = testSecretAccessKey
683+
}
684+
685+
iamClient := iam.NewFromConfig(aws.Config{
686+
Region: testRegion,
687+
Credentials: aws.CredentialsProviderFunc(func(ctx context.Context) (aws.Credentials, error) {
688+
return aws.Credentials{
689+
AccessKeyID: accessKey,
690+
SecretAccessKey: secretKey,
691+
}, nil
692+
}),
693+
}, func(o *iam.Options) {
694+
o.BaseEndpoint = aws.String(iamEndpoint)
695+
})
696+
697+
_, err := iamClient.CreateUser(ctx, &iam.CreateUserInput{
698+
UserName: aws.String(userName),
699+
})
700+
Expect(err).NotTo(HaveOccurred(), "CreateUser should succeed")
701+
702+
createKeyResp, err := iamClient.CreateAccessKey(ctx, &iam.CreateAccessKeyInput{
703+
UserName: aws.String(userName),
704+
})
705+
Expect(err).NotTo(HaveOccurred(), "CreateAccessKey should succeed")
706+
707+
if policyName != "" && policyDocument != "" {
708+
_, err = iamClient.PutUserPolicy(ctx, &iam.PutUserPolicyInput{
709+
UserName: aws.String(userName),
710+
PolicyName: aws.String(policyName),
711+
PolicyDocument: aws.String(policyDocument),
712+
})
713+
Expect(err).NotTo(HaveOccurred(), "PutUserPolicy should succeed")
714+
}
715+
716+
cleanup := func() {
717+
if policyName != "" {
718+
_, _ = iamClient.DeleteUserPolicy(ctx, &iam.DeleteUserPolicyInput{
719+
UserName: aws.String(userName),
720+
PolicyName: aws.String(policyName),
721+
})
722+
}
723+
_, _ = iamClient.DeleteAccessKey(ctx, &iam.DeleteAccessKeyInput{
724+
UserName: aws.String(userName),
725+
AccessKeyId: createKeyResp.AccessKey.AccessKeyId,
726+
})
727+
_, _ = iamClient.DeleteUser(ctx, &iam.DeleteUserInput{
728+
UserName: aws.String(userName),
729+
})
730+
}
731+
732+
s3Client := newS3ClientWithCredentials(
733+
*createKeyResp.AccessKey.AccessKeyId,
734+
*createKeyResp.AccessKey.SecretAccessKey,
735+
)
736+
737+
return IAMUserResult{S3Client: s3Client, Cleanup: cleanup}
738+
}
739+
661740
// setupE2ETest creates and initializes an E2E test context
662741
func setupE2ETest() *E2ETestContext {
663742
GinkgoHelper()

0 commit comments

Comments
 (0)