Skip to content

Commit ec8e002

Browse files
lehmanmjlehmanmj
authored
chore: add pre-release integ tests (#1457)
* add pre-release integ tests * chore: remove unnecessary sudo and reorganize test files
1 parent 1b2b73e commit ec8e002

File tree

3 files changed

+211
-0
lines changed

3 files changed

+211
-0
lines changed

‎.github/integ_tests/fetch-token.js‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
import core from "@actions/core";
2+
import fs from "fs/promises";
3+
4+
async function getIDTokenAction() {
5+
const id_token = await core.getIDToken("sts.amazonaws.com");
6+
return id_token;
7+
}
8+
let idToken = await getIDTokenAction();
9+
10+
await fs.writeFile(".github/integ_tests/integ_token.txt", idToken, (err) => {
11+
if (err) throw err;
12+
});

‎.github/integ_tests/tinyproxy.conf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Port 9999
2+
Listen 127.0.0.1
3+
Timeout 600
4+
Allow 127.0.0.1
5+
LogFile "/home/runner/work/configure-aws-credentials/configure-aws-credentials/integ_proxy_log.txt"
6+
LogLevel Connect

‎.github/workflows/tests-integ-release.yml‎

Lines changed: 193 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,193 @@
1+
name: Run pre-release integ tests
2+
on:
3+
pull_request_target:
4+
permissions:
5+
contents: read
6+
7+
jobs:
8+
oidc:
9+
if: ${{ github.event.pull_request.user.login == 'aws-sdk-osds' && github.repository == 'aws-actions/configure-aws-credentials' }}
10+
permissions:
11+
id-token: write
12+
strategy:
13+
fail-fast: false
14+
matrix:
15+
os: [windows-latest, ubuntu-latest, macos-latest]
16+
runs-on: ${{ matrix.os }}
17+
name: OIDC login test
18+
steps:
19+
- name: checkout
20+
uses: actions/checkout@v5
21+
with:
22+
fetch-depth: 0
23+
persist-credentials: false
24+
- name: Configure AWS credentials
25+
uses: ./
26+
with:
27+
aws-region: us-west-2
28+
role-to-assume: ${{ secrets.OIDC_integ_role }}
29+
- name: Get Caller Identity
30+
run: |
31+
aws sts get-caller-identity
32+
33+
#can cut this test out if it's not necessary
34+
static_assumeRole:
35+
if: ${{ github.event.pull_request.user.login == 'aws-sdk-osds' && github.repository == 'aws-actions/configure-aws-credentials' }}
36+
strategy:
37+
fail-fast: false
38+
matrix:
39+
os: [windows-latest, ubuntu-latest, macos-latest]
40+
runs-on: ${{ matrix.os }}
41+
name: Static IAM creds test
42+
steps:
43+
- name: checkout
44+
uses: actions/checkout@v5
45+
with:
46+
fetch-depth: 0
47+
persist-credentials: false
48+
- name: Configure AWS credentials
49+
uses: ./
50+
with:
51+
aws-region: us-west-2
52+
aws-access-key-id: ${{ secrets.STATIC_ak_id }}
53+
aws-secret-access-key: ${{ secrets.STATIC_secret_ak }}
54+
role-to-assume: ${{ secrets.STATIC_role }}
55+
- name: Get Caller Identity
56+
run: |
57+
aws sts get-caller-identity
58+
59+
role_chaining:
60+
if: ${{ github.event.pull_request.user.login == 'aws-sdk-osds' && github.repository == 'aws-actions/configure-aws-credentials' }}
61+
permissions:
62+
id-token: write
63+
strategy:
64+
fail-fast: false
65+
matrix:
66+
os: [windows-latest, ubuntu-latest, macos-latest]
67+
runs-on: ${{ matrix.os }}
68+
name: Existing Creds + Role Chaining test
69+
steps:
70+
- name: checkout
71+
uses: actions/checkout@v5
72+
with:
73+
fetch-depth: 0
74+
persist-credentials: false
75+
- name: Configure AWS credentials
76+
uses: ./
77+
with:
78+
aws-region: us-west-2
79+
role-to-assume: ${{ secrets.ROLE_chaining_1 }}
80+
- name: Get Caller Identity
81+
run: |
82+
aws sts get-caller-identity
83+
- name: assume second role
84+
uses: ./
85+
with:
86+
aws-region: us-west-2
87+
role-to-assume: ${{ secrets.ROLE_chaining_2 }}
88+
role-chaining: true
89+
- name: get caller identity
90+
run: |
91+
aws sts get-caller-identity
92+
93+
inline_policy:
94+
if: ${{ github.event.pull_request.user.login == 'aws-sdk-osds' && github.repository == 'aws-actions/configure-aws-credentials' }}
95+
permissions:
96+
id-token: write
97+
strategy:
98+
fail-fast: false
99+
matrix:
100+
os: [windows-latest, ubuntu-latest, macos-latest]
101+
runs-on: ${{ matrix.os }}
102+
name: Inline Policy Test
103+
steps:
104+
- name: checkout
105+
uses: actions/checkout@v5
106+
with:
107+
fetch-depth: 0
108+
persist-credentials: false
109+
- name: get creds w scoped down policy
110+
uses: ./
111+
with:
112+
aws-region: us-west-2
113+
role-to-assume: ${{ secrets.INLINE_policy_role }}
114+
inline-session-policy: '{"Version":"2012-10-17","Statement":[{"Sid":"Stmt1","Effect":"Allow","Action":"s3:ListAllMyBuckets","Resource":"*"}]}'
115+
116+
#NOTE: This step should succeed. The role should have permission only to list all buckets.
117+
- name: list buckets
118+
run: |
119+
aws s3 ls
120+
121+
#NOTE: This step should fail. we don't want the role to have permission to see the bucket contents.
122+
- name: try to list bucket contents
123+
id: bucketContentsStep
124+
continue-on-error: true
125+
run: |
126+
aws s3 ls s3://cawsc-integ-tests-bucket
127+
128+
#But the test fails if we could list the bucket contents.
129+
- name: fail if we can list bucket contents
130+
if: steps.bucketContentsStep.outcome == 'success'
131+
run: exit 1
132+
133+
http-proxy:
134+
if: ${{ github.event.pull_request.user.login == 'aws-sdk-osds' && github.repository == 'aws-actions/configure-aws-credentials' }}
135+
permissions:
136+
id-token: write
137+
runs-on: ubuntu-latest
138+
name: HTTP Proxy Test
139+
steps:
140+
- name: checkout
141+
uses: actions/checkout@v5
142+
with:
143+
fetch-depth: 0
144+
persist-credentials: false
145+
- name: install tinyproxy
146+
run: |
147+
sudo apt-get update
148+
sudo apt-get -y install tinyproxy
149+
- name: start tinyproxy
150+
run: tinyproxy -c .github/integ_tests/tinyproxy.conf
151+
- name: Configure AWS credentials
152+
continue-on-error: true
153+
uses: ./
154+
with:
155+
aws-region: us-west-2
156+
role-to-assume: ${{ secrets.OIDC_integ_role }}
157+
http-proxy: http://127.0.0.1:9999
158+
retry-max-attempts: 4
159+
- name: checkout logs
160+
run: cat integ_proxy_log.txt
161+
- name: check logs to see if successful call
162+
run: grep -q "Request" integ_proxy_log.txt && echo "PROXY_CALL_LOGGED=1" >> $GITHUB_ENV || echo "PROXY_CALL_LOGGED=0" >> $GITHUB_ENV
163+
- name: fail job if bad call
164+
if: ${{ env.PROXY_CALL_LOGGED != 1 }}
165+
run: exit 1
166+
167+
token-file:
168+
if: ${{ github.event.pull_request.user.login == 'aws-sdk-osds' && github.repository == 'aws-actions/configure-aws-credentials' }}
169+
permissions:
170+
id-token: write
171+
strategy:
172+
fail-fast: false
173+
matrix:
174+
os: [windows-latest, ubuntu-latest, macos-latest]
175+
runs-on: ${{ matrix.os }}
176+
name: Token File Test
177+
steps:
178+
- name: checkout
179+
uses: actions/checkout@v5
180+
with:
181+
fetch-depth: 0
182+
persist-credentials: false
183+
- name: fetch token and write to file
184+
run: node .github/integ_tests/fetch-token.js
185+
- name: get creds with that file
186+
uses: ./
187+
with:
188+
aws-region: us-west-2
189+
role-to-assume: ${{ secrets.OIDC_integ_role }}
190+
web-identity-token-file: .github/integ_tests/integ_token.txt
191+
retry-max-attempts: 4
192+
- name: check creds
193+
run: aws sts get-caller-identity

0 commit comments

Comments
 (0)