mirror of
https://github.com/versity/versitygw.git
synced 2026-08-17 20:56:21 +00:00
feat: add IAM user access key management
Add `CreateAccessKey`, `UpdateAccessKey`, `DeleteAccessKey`, `ListAccessKeys`, and `GetAccessKeyLastUsed` actions for managing user access keys and retrieving their latest usage details. Generate AWS-style access key IDs and secrets, validate key identifiers and statuses, enforce per-user key quotas, and prevent deleting users that still own access keys. Persist access keys across internal and Vault storage backends with ownership indexing, pagination, and IAM-compatible errors and XML responses.
This commit is contained in:
niksis02
@@ -1165,6 +1165,7 @@ func TestIAMDeleteUser(ts *TestState) {
|
||||
ts.Run(IAMDeleteUser_invalid_user_name)
|
||||
ts.Run(IAMDeleteUser_long_user_name)
|
||||
ts.Run(IAMDeleteUser_non_existing_user)
|
||||
ts.Run(IAMDeleteUser_has_access_keys)
|
||||
ts.Run(IAMDeleteUser_success)
|
||||
}
|
||||
|
||||
@@ -1180,6 +1181,64 @@ func TestIAMUpdateUser(ts *TestState) {
|
||||
ts.Run(IAMUpdateUser_success)
|
||||
}
|
||||
|
||||
func TestIAMCreateAccessKey(ts *TestState) {
|
||||
ts.Run(IAMCreateAccessKey_missing_user_name)
|
||||
ts.Run(IAMCreateAccessKey_invalid_user_name)
|
||||
ts.Run(IAMCreateAccessKey_long_user_name)
|
||||
ts.Run(IAMCreateAccessKey_non_existing_user)
|
||||
ts.Run(IAMCreateAccessKey_limit_exceeded)
|
||||
ts.Run(IAMCreateAccessKey_success)
|
||||
}
|
||||
|
||||
func TestIAMUpdateAccessKey(ts *TestState) {
|
||||
ts.Run(IAMUpdateAccessKey_missing_user_name)
|
||||
ts.Run(IAMUpdateAccessKey_invalid_user_name)
|
||||
ts.Run(IAMUpdateAccessKey_long_user_name)
|
||||
ts.Run(IAMUpdateAccessKey_missing_access_key_id)
|
||||
ts.Run(IAMUpdateAccessKey_access_key_id_too_short)
|
||||
ts.Run(IAMUpdateAccessKey_access_key_id_too_long)
|
||||
ts.Run(IAMUpdateAccessKey_invalid_access_key_id_chars)
|
||||
ts.Run(IAMUpdateAccessKey_missing_status)
|
||||
ts.Run(IAMUpdateAccessKey_invalid_status)
|
||||
ts.Run(IAMUpdateAccessKey_non_existing_user)
|
||||
ts.Run(IAMUpdateAccessKey_non_existing_access_key)
|
||||
ts.Run(IAMUpdateAccessKey_success)
|
||||
}
|
||||
|
||||
func TestIAMDeleteAccessKey(ts *TestState) {
|
||||
ts.Run(IAMDeleteAccessKey_missing_user_name)
|
||||
ts.Run(IAMDeleteAccessKey_invalid_user_name)
|
||||
ts.Run(IAMDeleteAccessKey_long_user_name)
|
||||
ts.Run(IAMDeleteAccessKey_missing_access_key_id)
|
||||
ts.Run(IAMDeleteAccessKey_access_key_id_too_short)
|
||||
ts.Run(IAMDeleteAccessKey_access_key_id_too_long)
|
||||
ts.Run(IAMDeleteAccessKey_invalid_access_key_id_chars)
|
||||
ts.Run(IAMDeleteAccessKey_non_existing_user)
|
||||
ts.Run(IAMDeleteAccessKey_non_existing_access_key)
|
||||
ts.Run(IAMDeleteAccessKey_success)
|
||||
}
|
||||
|
||||
func TestIAMGetAccessKeyLastUsed(ts *TestState) {
|
||||
ts.Run(IAMGetAccessKeyLastUsed_missing_access_key_id)
|
||||
ts.Run(IAMGetAccessKeyLastUsed_access_key_id_too_short)
|
||||
ts.Run(IAMGetAccessKeyLastUsed_access_key_id_too_long)
|
||||
ts.Run(IAMGetAccessKeyLastUsed_invalid_access_key_id_chars)
|
||||
ts.Run(IAMGetAccessKeyLastUsed_non_existing_access_key)
|
||||
ts.Run(IAMGetAccessKeyLastUsed_success)
|
||||
}
|
||||
|
||||
func TestIAMListAccessKeys(ts *TestState) {
|
||||
ts.Run(IAMListAccessKeys_missing_user_name)
|
||||
ts.Run(IAMListAccessKeys_invalid_user_name)
|
||||
ts.Run(IAMListAccessKeys_long_user_name)
|
||||
ts.Run(IAMListAccessKeys_invalid_max_items)
|
||||
ts.Run(IAMListAccessKeys_invalid_max_items_format)
|
||||
ts.Run(IAMListAccessKeys_non_existing_user)
|
||||
ts.Run(IAMListAccessKeys_empty_result)
|
||||
ts.Run(IAMListAccessKeys_success)
|
||||
ts.Run(IAMListAccessKeys_pagination)
|
||||
}
|
||||
|
||||
func TestIAM(ts *TestState) {
|
||||
TestIAMAuth(ts)
|
||||
TestIAMQueryAuth(ts)
|
||||
@@ -1188,6 +1247,11 @@ func TestIAM(ts *TestState) {
|
||||
TestIAMListUsers(ts)
|
||||
TestIAMDeleteUser(ts)
|
||||
TestIAMUpdateUser(ts)
|
||||
TestIAMCreateAccessKey(ts)
|
||||
TestIAMUpdateAccessKey(ts)
|
||||
TestIAMDeleteAccessKey(ts)
|
||||
TestIAMGetAccessKeyLastUsed(ts)
|
||||
TestIAMListAccessKeys(ts)
|
||||
}
|
||||
|
||||
func TestAccessControl(ts *TestState) {
|
||||
@@ -1572,6 +1636,7 @@ func GetIntTests() IntTests {
|
||||
"IAMDeleteUser_invalid_user_name": IAMDeleteUser_invalid_user_name,
|
||||
"IAMDeleteUser_long_user_name": IAMDeleteUser_long_user_name,
|
||||
"IAMDeleteUser_non_existing_user": IAMDeleteUser_non_existing_user,
|
||||
"IAMDeleteUser_has_access_keys": IAMDeleteUser_has_access_keys,
|
||||
"IAMDeleteUser_success": IAMDeleteUser_success,
|
||||
"IAMUpdateUser_invalid_user_name": IAMUpdateUser_invalid_user_name,
|
||||
"IAMUpdateUser_long_user_name": IAMUpdateUser_long_user_name,
|
||||
@@ -1582,6 +1647,49 @@ func GetIntTests() IntTests {
|
||||
"IAMUpdateUser_long_new_path": IAMUpdateUser_long_new_path,
|
||||
"IAMUpdateUser_new_user_name_already_exists": IAMUpdateUser_new_user_name_already_exists,
|
||||
"IAMUpdateUser_success": IAMUpdateUser_success,
|
||||
"IAMCreateAccessKey_missing_user_name": IAMCreateAccessKey_missing_user_name,
|
||||
"IAMCreateAccessKey_invalid_user_name": IAMCreateAccessKey_invalid_user_name,
|
||||
"IAMCreateAccessKey_long_user_name": IAMCreateAccessKey_long_user_name,
|
||||
"IAMCreateAccessKey_non_existing_user": IAMCreateAccessKey_non_existing_user,
|
||||
"IAMCreateAccessKey_limit_exceeded": IAMCreateAccessKey_limit_exceeded,
|
||||
"IAMCreateAccessKey_success": IAMCreateAccessKey_success,
|
||||
"IAMUpdateAccessKey_missing_user_name": IAMUpdateAccessKey_missing_user_name,
|
||||
"IAMUpdateAccessKey_invalid_user_name": IAMUpdateAccessKey_invalid_user_name,
|
||||
"IAMUpdateAccessKey_long_user_name": IAMUpdateAccessKey_long_user_name,
|
||||
"IAMUpdateAccessKey_missing_access_key_id": IAMUpdateAccessKey_missing_access_key_id,
|
||||
"IAMUpdateAccessKey_access_key_id_too_short": IAMUpdateAccessKey_access_key_id_too_short,
|
||||
"IAMUpdateAccessKey_access_key_id_too_long": IAMUpdateAccessKey_access_key_id_too_long,
|
||||
"IAMUpdateAccessKey_invalid_access_key_id_chars": IAMUpdateAccessKey_invalid_access_key_id_chars,
|
||||
"IAMUpdateAccessKey_missing_status": IAMUpdateAccessKey_missing_status,
|
||||
"IAMUpdateAccessKey_invalid_status": IAMUpdateAccessKey_invalid_status,
|
||||
"IAMUpdateAccessKey_non_existing_user": IAMUpdateAccessKey_non_existing_user,
|
||||
"IAMUpdateAccessKey_non_existing_access_key": IAMUpdateAccessKey_non_existing_access_key,
|
||||
"IAMUpdateAccessKey_success": IAMUpdateAccessKey_success,
|
||||
"IAMDeleteAccessKey_missing_user_name": IAMDeleteAccessKey_missing_user_name,
|
||||
"IAMDeleteAccessKey_invalid_user_name": IAMDeleteAccessKey_invalid_user_name,
|
||||
"IAMDeleteAccessKey_long_user_name": IAMDeleteAccessKey_long_user_name,
|
||||
"IAMDeleteAccessKey_missing_access_key_id": IAMDeleteAccessKey_missing_access_key_id,
|
||||
"IAMDeleteAccessKey_access_key_id_too_short": IAMDeleteAccessKey_access_key_id_too_short,
|
||||
"IAMDeleteAccessKey_access_key_id_too_long": IAMDeleteAccessKey_access_key_id_too_long,
|
||||
"IAMDeleteAccessKey_invalid_access_key_id_chars": IAMDeleteAccessKey_invalid_access_key_id_chars,
|
||||
"IAMDeleteAccessKey_non_existing_user": IAMDeleteAccessKey_non_existing_user,
|
||||
"IAMDeleteAccessKey_non_existing_access_key": IAMDeleteAccessKey_non_existing_access_key,
|
||||
"IAMDeleteAccessKey_success": IAMDeleteAccessKey_success,
|
||||
"IAMGetAccessKeyLastUsed_missing_access_key_id": IAMGetAccessKeyLastUsed_missing_access_key_id,
|
||||
"IAMGetAccessKeyLastUsed_access_key_id_too_short": IAMGetAccessKeyLastUsed_access_key_id_too_short,
|
||||
"IAMGetAccessKeyLastUsed_access_key_id_too_long": IAMGetAccessKeyLastUsed_access_key_id_too_long,
|
||||
"IAMGetAccessKeyLastUsed_invalid_access_key_id_chars": IAMGetAccessKeyLastUsed_invalid_access_key_id_chars,
|
||||
"IAMGetAccessKeyLastUsed_non_existing_access_key": IAMGetAccessKeyLastUsed_non_existing_access_key,
|
||||
"IAMGetAccessKeyLastUsed_success": IAMGetAccessKeyLastUsed_success,
|
||||
"IAMListAccessKeys_missing_user_name": IAMListAccessKeys_missing_user_name,
|
||||
"IAMListAccessKeys_invalid_user_name": IAMListAccessKeys_invalid_user_name,
|
||||
"IAMListAccessKeys_long_user_name": IAMListAccessKeys_long_user_name,
|
||||
"IAMListAccessKeys_invalid_max_items": IAMListAccessKeys_invalid_max_items,
|
||||
"IAMListAccessKeys_invalid_max_items_format": IAMListAccessKeys_invalid_max_items_format,
|
||||
"IAMListAccessKeys_non_existing_user": IAMListAccessKeys_non_existing_user,
|
||||
"IAMListAccessKeys_empty_result": IAMListAccessKeys_empty_result,
|
||||
"IAMListAccessKeys_success": IAMListAccessKeys_success,
|
||||
"IAMListAccessKeys_pagination": IAMListAccessKeys_pagination,
|
||||
"PresignedAuth_security_token_not_supported": PresignedAuth_security_token_not_supported,
|
||||
"PresignedAuth_unsupported_algorithm": PresignedAuth_unsupported_algorithm,
|
||||
"PresignedAuth_ECDSA_not_supported": PresignedAuth_ECDSA_not_supported,
|
||||
|
||||
@@ -0,0 +1,151 @@
|
||||
// Copyright 2026 Versity Software
|
||||
// This file is licensed under the Apache License, Version 2.0
|
||||
// (the "License"); you may not use this file except in compliance
|
||||
// with the License. You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing,
|
||||
// software distributed under the License is distributed on an
|
||||
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
||||
// KIND, either express or implied. See the License for the
|
||||
// specific language governing permissions and limitations
|
||||
// under the License.
|
||||
|
||||
package integration
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"regexp"
|
||||
"strings"
|
||||
|
||||
"github.com/aws/aws-sdk-go-v2/aws"
|
||||
awsmiddleware "github.com/aws/aws-sdk-go-v2/aws/middleware"
|
||||
"github.com/aws/aws-sdk-go-v2/service/iam"
|
||||
iamtypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
|
||||
"github.com/versity/versitygw/iamapi/iamerr"
|
||||
)
|
||||
|
||||
var integrationIAMAccessKeyIDPattern = regexp.MustCompile(`^AKIA[A-Z2-7]{17}$`)
|
||||
|
||||
func IAMCreateAccessKey_missing_user_name(s *S3Conf) error {
|
||||
testName := "IAMCreateAccessKey_missing_user_name"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
_, err := createIAMAccessKey(client, &iam.CreateAccessKeyInput{})
|
||||
return checkIAMApiErr(err, iamerr.MissingParameter("UserName"))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMCreateAccessKey_invalid_user_name(s *S3Conf) error {
|
||||
testName := "IAMCreateAccessKey_invalid_user_name"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
_, err := createIAMAccessKey(client, &iam.CreateAccessKeyInput{
|
||||
UserName: aws.String("invalid/user"),
|
||||
})
|
||||
return checkIAMApiErr(err, iamerr.InvalidUserName("userName"))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMCreateAccessKey_long_user_name(s *S3Conf) error {
|
||||
testName := "IAMCreateAccessKey_long_user_name"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
_, err := createIAMAccessKey(client, &iam.CreateAccessKeyInput{
|
||||
UserName: aws.String(strings.Repeat("a", 129)),
|
||||
})
|
||||
return checkIAMApiErr(err, iamerr.UserNameTooLong("userName", 128))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMCreateAccessKey_non_existing_user(s *S3Conf) error {
|
||||
testName := "IAMCreateAccessKey_non_existing_user"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
userName := "non-existing-" + genRandString(16)
|
||||
_, err := createIAMAccessKey(client, &iam.CreateAccessKeyInput{UserName: &userName})
|
||||
return checkIAMApiErr(err, iamerr.NoSuchEntityUser(userName))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMCreateAccessKey_limit_exceeded(s *S3Conf) error {
|
||||
testName := "IAMCreateAccessKey_limit_exceeded"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
userName := newIAMUserName()
|
||||
if _, err := createIAMUser(client, &iam.CreateUserInput{UserName: &userName}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
checkErr := func() error {
|
||||
for range 2 {
|
||||
if _, err := createIAMAccessKey(client, &iam.CreateAccessKeyInput{UserName: &userName}); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
_, err := createIAMAccessKey(client, &iam.CreateAccessKeyInput{UserName: &userName})
|
||||
return checkIAMApiErr(err, iamerr.AccessKeysLimitExceeded(2))
|
||||
}()
|
||||
|
||||
deleteErr := deleteIAMUserAndAccessKeys(client, userName)
|
||||
if checkErr != nil {
|
||||
return checkErr
|
||||
}
|
||||
return deleteErr
|
||||
})
|
||||
}
|
||||
|
||||
func IAMCreateAccessKey_success(s *S3Conf) error {
|
||||
testName := "IAMCreateAccessKey_success"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
userName := newIAMUserName()
|
||||
if _, err := createIAMUser(client, &iam.CreateUserInput{UserName: &userName}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
out, err := createIAMAccessKey(client, &iam.CreateAccessKeyInput{UserName: &userName})
|
||||
checkErr := func() error {
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return checkCreateAccessKeyOutput(out, userName)
|
||||
}()
|
||||
|
||||
deleteErr := deleteIAMUserAndAccessKeys(client, userName)
|
||||
if checkErr != nil {
|
||||
return checkErr
|
||||
}
|
||||
return deleteErr
|
||||
})
|
||||
}
|
||||
|
||||
func createIAMAccessKey(client *iam.Client, input *iam.CreateAccessKeyInput) (*iam.CreateAccessKeyOutput, error) {
|
||||
ctx, cancel := context.WithTimeout(context.Background(), shortTimeout)
|
||||
defer cancel()
|
||||
return client.CreateAccessKey(ctx, input)
|
||||
}
|
||||
|
||||
func checkCreateAccessKeyOutput(out *iam.CreateAccessKeyOutput, userName string) error {
|
||||
if out == nil || out.AccessKey == nil {
|
||||
return fmt.Errorf("expected CreateAccessKey output access key")
|
||||
}
|
||||
|
||||
key := out.AccessKey
|
||||
if aws.ToString(key.UserName) != userName {
|
||||
return fmt.Errorf("expected access key user name to be %q, instead got %q", userName, aws.ToString(key.UserName))
|
||||
}
|
||||
if !integrationIAMAccessKeyIDPattern.MatchString(aws.ToString(key.AccessKeyId)) {
|
||||
return fmt.Errorf("expected AWS IAM access key id, instead got %q", aws.ToString(key.AccessKeyId))
|
||||
}
|
||||
if key.Status != iamtypes.StatusTypeActive {
|
||||
return fmt.Errorf("expected access key status to be %q, instead got %q", iamtypes.StatusTypeActive, key.Status)
|
||||
}
|
||||
if aws.ToString(key.SecretAccessKey) == "" {
|
||||
return fmt.Errorf("expected access key secret")
|
||||
}
|
||||
if key.CreateDate == nil || key.CreateDate.IsZero() {
|
||||
return fmt.Errorf("expected access key create date")
|
||||
}
|
||||
if requestID, ok := awsmiddleware.GetRequestIDMetadata(out.ResultMetadata); !ok || requestID == "" {
|
||||
return fmt.Errorf("expected CreateAccessKey response request id")
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
@@ -228,6 +228,23 @@ func deleteIAMUser(client *iam.Client, userName string) error {
|
||||
return err
|
||||
}
|
||||
|
||||
// deleteIAMUserAndAccessKeys deletes all of the user's access keys before
|
||||
// deleting the user, since DeleteUser rejects users with access keys still
|
||||
// attached. Use this for test cleanup after a test has created access keys;
|
||||
// use deleteIAMUser directly when the test itself manages key deletion.
|
||||
func deleteIAMUserAndAccessKeys(client *iam.Client, userName string) error {
|
||||
out, err := listIAMAccessKeys(client, &iam.ListAccessKeysInput{UserName: &userName})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
for _, key := range out.AccessKeyMetadata {
|
||||
if err := deleteIAMAccessKey(client, userName, aws.ToString(key.AccessKeyId)); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
return deleteIAMUser(client, userName)
|
||||
}
|
||||
|
||||
func newIAMUserName() string {
|
||||
return "create-user-" + genRandString(16)
|
||||
}
|
||||
|
||||
@@ -0,0 +1,169 @@
|
||||
// Copyright 2026 Versity Software
|
||||
// This file is licensed under the Apache License, Version 2.0
|
||||
// (the "License"); you may not use this file except in compliance
|
||||
// with the License. You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing,
|
||||
// software distributed under the License is distributed on an
|
||||
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
||||
// KIND, either express or implied. See the License for the
|
||||
// specific language governing permissions and limitations
|
||||
// under the License.
|
||||
|
||||
package integration
|
||||
|
||||
import (
|
||||
"context"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/aws/aws-sdk-go-v2/aws"
|
||||
"github.com/aws/aws-sdk-go-v2/service/iam"
|
||||
"github.com/versity/versitygw/iamapi/iamerr"
|
||||
)
|
||||
|
||||
func IAMDeleteAccessKey_missing_user_name(s *S3Conf) error {
|
||||
testName := "IAMDeleteAccessKey_missing_user_name"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
err := deleteIAMAccessKey(client, "", genRandString(20))
|
||||
return checkIAMApiErr(err, iamerr.MissingParameter("UserName"))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMDeleteAccessKey_invalid_user_name(s *S3Conf) error {
|
||||
testName := "IAMDeleteAccessKey_invalid_user_name"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
err := deleteIAMAccessKey(client, "invalid/user", genRandString(20))
|
||||
return checkIAMApiErr(err, iamerr.InvalidUserName("userName"))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMDeleteAccessKey_long_user_name(s *S3Conf) error {
|
||||
testName := "IAMDeleteAccessKey_long_user_name"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
err := deleteIAMAccessKey(client, strings.Repeat("a", 129), genRandString(20))
|
||||
return checkIAMApiErr(err, iamerr.UserNameTooLong("userName", 128))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMDeleteAccessKey_missing_access_key_id(s *S3Conf) error {
|
||||
testName := "IAMDeleteAccessKey_missing_access_key_id"
|
||||
body := []byte(url.Values{
|
||||
"Action": {"DeleteAccessKey"},
|
||||
"Version": {"2010-05-08"},
|
||||
"UserName": {"validusername"},
|
||||
}.Encode())
|
||||
return authHandler(s, &authConfig{
|
||||
testName: testName,
|
||||
method: http.MethodPost,
|
||||
service: "iam",
|
||||
region: iamAuthRegion,
|
||||
body: body,
|
||||
date: time.Now().UTC(),
|
||||
headers: map[string]string{
|
||||
"Content-Type": "application/x-www-form-urlencoded",
|
||||
},
|
||||
}, func(req *http.Request) error {
|
||||
return checkIAMAuthRequest(s, req, iamerr.MissingParameter("AccessKeyId"))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMDeleteAccessKey_access_key_id_too_short(s *S3Conf) error {
|
||||
testName := "IAMDeleteAccessKey_access_key_id_too_short"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
err := deleteIAMAccessKey(client, "validusername", genRandString(15))
|
||||
return checkIAMApiErr(err, iamerr.AccessKeyIDTooShort(16))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMDeleteAccessKey_access_key_id_too_long(s *S3Conf) error {
|
||||
testName := "IAMDeleteAccessKey_access_key_id_too_long"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
err := deleteIAMAccessKey(client, "validusername", genRandString(129))
|
||||
return checkIAMApiErr(err, iamerr.AccessKeyIDTooLong(128))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMDeleteAccessKey_invalid_access_key_id_chars(s *S3Conf) error {
|
||||
testName := "IAMDeleteAccessKey_invalid_access_key_id_chars"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
err := deleteIAMAccessKey(client, "validusername", "invalid-key-id-1234")
|
||||
return checkIAMApiErr(err, iamerr.GetAPIError(iamerr.ErrInvalidAccessKeyIDChars))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMDeleteAccessKey_non_existing_user(s *S3Conf) error {
|
||||
testName := "IAMDeleteAccessKey_non_existing_user"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
userName := "non-existing-" + genRandString(16)
|
||||
err := deleteIAMAccessKey(client, userName, genRandString(20))
|
||||
return checkIAMApiErr(err, iamerr.NoSuchEntityUser(userName))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMDeleteAccessKey_non_existing_access_key(s *S3Conf) error {
|
||||
testName := "IAMDeleteAccessKey_non_existing_access_key"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
userName := newIAMUserName()
|
||||
if _, err := createIAMUser(client, &iam.CreateUserInput{UserName: &userName}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
accessKeyID := genRandString(20)
|
||||
deleteErr := deleteIAMAccessKey(client, userName, accessKeyID)
|
||||
checkErr := checkIAMApiErr(deleteErr, iamerr.NoSuchEntityAccessKey(accessKeyID))
|
||||
|
||||
userDeleteErr := deleteIAMUser(client, userName)
|
||||
if checkErr != nil {
|
||||
return checkErr
|
||||
}
|
||||
return userDeleteErr
|
||||
})
|
||||
}
|
||||
|
||||
func IAMDeleteAccessKey_success(s *S3Conf) error {
|
||||
testName := "IAMDeleteAccessKey_success"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
userName := newIAMUserName()
|
||||
if _, err := createIAMUser(client, &iam.CreateUserInput{UserName: &userName}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
checkErr := func() error {
|
||||
created, err := createIAMAccessKey(client, &iam.CreateAccessKeyInput{UserName: &userName})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
accessKeyID := aws.ToString(created.AccessKey.AccessKeyId)
|
||||
|
||||
if err := deleteIAMAccessKey(client, userName, accessKeyID); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
_, err = getIAMAccessKeyLastUsed(client, accessKeyID)
|
||||
return checkIAMApiErr(err, iamerr.NoSuchEntityAccessKey(accessKeyID))
|
||||
}()
|
||||
|
||||
deleteErr := deleteIAMUser(client, userName)
|
||||
if checkErr != nil {
|
||||
return checkErr
|
||||
}
|
||||
return deleteErr
|
||||
})
|
||||
}
|
||||
|
||||
func deleteIAMAccessKey(client *iam.Client, userName, accessKeyID string) error {
|
||||
ctx, cancel := context.WithTimeout(context.Background(), shortTimeout)
|
||||
defer cancel()
|
||||
|
||||
input := &iam.DeleteAccessKeyInput{AccessKeyId: &accessKeyID}
|
||||
if userName != "" {
|
||||
input.UserName = &userName
|
||||
}
|
||||
_, err := client.DeleteAccessKey(ctx, input)
|
||||
return err
|
||||
}
|
||||
@@ -47,6 +47,35 @@ func IAMDeleteUser_non_existing_user(s *S3Conf) error {
|
||||
})
|
||||
}
|
||||
|
||||
func IAMDeleteUser_has_access_keys(s *S3Conf) error {
|
||||
testName := "IAMDeleteUser_has_access_keys"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
userName := newIAMUserName()
|
||||
if _, err := createIAMUser(client, &iam.CreateUserInput{UserName: &userName}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
out, err := createIAMAccessKey(client, &iam.CreateAccessKeyInput{UserName: &userName})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
accessKeyID := aws.ToString(out.AccessKey.AccessKeyId)
|
||||
|
||||
checkErr := checkIAMApiErr(deleteIAMUser(client, userName), iamerr.GetAPIError(iamerr.ErrDeleteConflict))
|
||||
|
||||
deleteKeyErr := deleteIAMAccessKey(client, userName, accessKeyID)
|
||||
deleteUserErr := deleteIAMUser(client, userName)
|
||||
|
||||
if checkErr != nil {
|
||||
return checkErr
|
||||
}
|
||||
if deleteKeyErr != nil {
|
||||
return deleteKeyErr
|
||||
}
|
||||
return deleteUserErr
|
||||
})
|
||||
}
|
||||
|
||||
func IAMDeleteUser_success(s *S3Conf) error {
|
||||
testName := "IAMDeleteUser_success"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
|
||||
@@ -0,0 +1,137 @@
|
||||
// Copyright 2026 Versity Software
|
||||
// This file is licensed under the Apache License, Version 2.0
|
||||
// (the "License"); you may not use this file except in compliance
|
||||
// with the License. You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing,
|
||||
// software distributed under the License is distributed on an
|
||||
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
||||
// KIND, either express or implied. See the License for the
|
||||
// specific language governing permissions and limitations
|
||||
// under the License.
|
||||
|
||||
package integration
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"time"
|
||||
|
||||
"github.com/aws/aws-sdk-go-v2/aws"
|
||||
awsmiddleware "github.com/aws/aws-sdk-go-v2/aws/middleware"
|
||||
"github.com/aws/aws-sdk-go-v2/service/iam"
|
||||
"github.com/versity/versitygw/iamapi/iamerr"
|
||||
)
|
||||
|
||||
func IAMGetAccessKeyLastUsed_missing_access_key_id(s *S3Conf) error {
|
||||
testName := "IAMGetAccessKeyLastUsed_missing_access_key_id"
|
||||
body := []byte(url.Values{
|
||||
"Action": {"GetAccessKeyLastUsed"},
|
||||
"Version": {"2010-05-08"},
|
||||
}.Encode())
|
||||
return authHandler(s, &authConfig{
|
||||
testName: testName,
|
||||
method: http.MethodPost,
|
||||
service: "iam",
|
||||
region: iamAuthRegion,
|
||||
body: body,
|
||||
date: time.Now().UTC(),
|
||||
headers: map[string]string{
|
||||
"Content-Type": "application/x-www-form-urlencoded",
|
||||
},
|
||||
}, func(req *http.Request) error {
|
||||
return checkIAMAuthRequest(s, req, iamerr.MissingParameter("AccessKeyId"))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMGetAccessKeyLastUsed_access_key_id_too_short(s *S3Conf) error {
|
||||
testName := "IAMGetAccessKeyLastUsed_access_key_id_too_short"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
_, err := getIAMAccessKeyLastUsed(client, genRandString(15))
|
||||
return checkIAMApiErr(err, iamerr.AccessKeyIDTooShort(16))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMGetAccessKeyLastUsed_access_key_id_too_long(s *S3Conf) error {
|
||||
testName := "IAMGetAccessKeyLastUsed_access_key_id_too_long"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
_, err := getIAMAccessKeyLastUsed(client, genRandString(129))
|
||||
return checkIAMApiErr(err, iamerr.AccessKeyIDTooLong(128))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMGetAccessKeyLastUsed_invalid_access_key_id_chars(s *S3Conf) error {
|
||||
testName := "IAMGetAccessKeyLastUsed_invalid_access_key_id_chars"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
_, err := getIAMAccessKeyLastUsed(client, "invalid-key-id-1234")
|
||||
return checkIAMApiErr(err, iamerr.GetAPIError(iamerr.ErrInvalidAccessKeyIDChars))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMGetAccessKeyLastUsed_non_existing_access_key(s *S3Conf) error {
|
||||
testName := "IAMGetAccessKeyLastUsed_non_existing_access_key"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
accessKeyID := genRandString(20)
|
||||
_, err := getIAMAccessKeyLastUsed(client, accessKeyID)
|
||||
return checkIAMApiErr(err, iamerr.NoSuchEntityAccessKey(accessKeyID))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMGetAccessKeyLastUsed_success(s *S3Conf) error {
|
||||
testName := "IAMGetAccessKeyLastUsed_success"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
userName := newIAMUserName()
|
||||
if _, err := createIAMUser(client, &iam.CreateUserInput{UserName: &userName}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
checkErr := func() error {
|
||||
created, err := createIAMAccessKey(client, &iam.CreateAccessKeyInput{UserName: &userName})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
accessKeyID := aws.ToString(created.AccessKey.AccessKeyId)
|
||||
|
||||
out, err := getIAMAccessKeyLastUsed(client, accessKeyID)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if out == nil || out.AccessKeyLastUsed == nil {
|
||||
return fmt.Errorf("expected GetAccessKeyLastUsed output")
|
||||
}
|
||||
if aws.ToString(out.UserName) != userName {
|
||||
return fmt.Errorf("expected access key user name to be %q, instead got %q", userName, aws.ToString(out.UserName))
|
||||
}
|
||||
if aws.ToString(out.AccessKeyLastUsed.ServiceName) != "N/A" {
|
||||
return fmt.Errorf("expected access key last used service name to be %q, instead got %q", "N/A", aws.ToString(out.AccessKeyLastUsed.ServiceName))
|
||||
}
|
||||
if aws.ToString(out.AccessKeyLastUsed.Region) != "N/A" {
|
||||
return fmt.Errorf("expected access key last used region to be %q, instead got %q", "N/A", aws.ToString(out.AccessKeyLastUsed.Region))
|
||||
}
|
||||
if out.AccessKeyLastUsed.LastUsedDate != nil {
|
||||
return fmt.Errorf("expected no access key last used date, instead got %v", out.AccessKeyLastUsed.LastUsedDate)
|
||||
}
|
||||
if requestID, ok := awsmiddleware.GetRequestIDMetadata(out.ResultMetadata); !ok || requestID == "" {
|
||||
return fmt.Errorf("expected GetAccessKeyLastUsed response request id")
|
||||
}
|
||||
|
||||
return nil
|
||||
}()
|
||||
|
||||
deleteErr := deleteIAMUserAndAccessKeys(client, userName)
|
||||
if checkErr != nil {
|
||||
return checkErr
|
||||
}
|
||||
return deleteErr
|
||||
})
|
||||
}
|
||||
|
||||
func getIAMAccessKeyLastUsed(client *iam.Client, accessKeyID string) (*iam.GetAccessKeyLastUsedOutput, error) {
|
||||
ctx, cancel := context.WithTimeout(context.Background(), shortTimeout)
|
||||
defer cancel()
|
||||
return client.GetAccessKeyLastUsed(ctx, &iam.GetAccessKeyLastUsedInput{AccessKeyId: &accessKeyID})
|
||||
}
|
||||
@@ -0,0 +1,331 @@
|
||||
// Copyright 2026 Versity Software
|
||||
// This file is licensed under the Apache License, Version 2.0
|
||||
// (the "License"); you may not use this file except in compliance
|
||||
// with the License. You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing,
|
||||
// software distributed under the License is distributed on an
|
||||
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
||||
// KIND, either express or implied. See the License for the
|
||||
// specific language governing permissions and limitations
|
||||
// under the License.
|
||||
|
||||
package integration
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"reflect"
|
||||
"sort"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/aws/aws-sdk-go-v2/aws"
|
||||
awsmiddleware "github.com/aws/aws-sdk-go-v2/aws/middleware"
|
||||
"github.com/aws/aws-sdk-go-v2/service/iam"
|
||||
iamtypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
|
||||
"github.com/versity/versitygw/iamapi/iamerr"
|
||||
)
|
||||
|
||||
func IAMListAccessKeys_missing_user_name(s *S3Conf) error {
|
||||
testName := "IAMListAccessKeys_missing_user_name"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
_, err := listIAMAccessKeys(client, &iam.ListAccessKeysInput{})
|
||||
return checkIAMApiErr(err, iamerr.MissingParameter("UserName"))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMListAccessKeys_invalid_user_name(s *S3Conf) error {
|
||||
testName := "IAMListAccessKeys_invalid_user_name"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
_, err := listIAMAccessKeys(client, &iam.ListAccessKeysInput{
|
||||
UserName: aws.String("invalid/user"),
|
||||
})
|
||||
return checkIAMApiErr(err, iamerr.InvalidUserName("userName"))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMListAccessKeys_long_user_name(s *S3Conf) error {
|
||||
testName := "IAMListAccessKeys_long_user_name"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
_, err := listIAMAccessKeys(client, &iam.ListAccessKeysInput{
|
||||
UserName: aws.String(strings.Repeat("a", 129)),
|
||||
})
|
||||
return checkIAMApiErr(err, iamerr.UserNameTooLong("userName", 128))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMListAccessKeys_invalid_max_items(s *S3Conf) error {
|
||||
testName := "IAMListAccessKeys_invalid_max_items"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
userName := "non-existing-" + genRandString(16)
|
||||
for _, maxItems := range []int32{-1, 0, 1001} {
|
||||
_, err := listIAMAccessKeys(client, &iam.ListAccessKeysInput{
|
||||
UserName: &userName,
|
||||
MaxItems: aws.Int32(maxItems),
|
||||
})
|
||||
expected := iamerr.InvalidMaxItems(fmt.Sprint(maxItems))
|
||||
if checkErr := checkIAMApiErr(err, expected); checkErr != nil {
|
||||
return fmt.Errorf("MaxItems %d: %w", maxItems, checkErr)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
})
|
||||
}
|
||||
|
||||
func IAMListAccessKeys_invalid_max_items_format(s *S3Conf) error {
|
||||
testName := "IAMListAccessKeys_invalid_max_items_format"
|
||||
body := []byte(url.Values{
|
||||
"Action": {"ListAccessKeys"},
|
||||
"Version": {"2010-05-08"},
|
||||
"UserName": {"validusername"},
|
||||
"MaxItems": {"not-a-number"},
|
||||
}.Encode())
|
||||
return authHandler(s, &authConfig{
|
||||
testName: testName,
|
||||
method: http.MethodPost,
|
||||
service: "iam",
|
||||
region: iamAuthRegion,
|
||||
body: body,
|
||||
date: time.Now().UTC(),
|
||||
headers: map[string]string{"Content-Type": "application/x-www-form-urlencoded"},
|
||||
}, func(req *http.Request) error {
|
||||
expected := iamerr.ValidationError("1 validation error detected: Value 'not-a-number' at 'maxItems' failed to satisfy constraint: Member must have value between 1 and 1000")
|
||||
return checkIAMAuthRequest(s, req, expected)
|
||||
})
|
||||
}
|
||||
|
||||
func IAMListAccessKeys_non_existing_user(s *S3Conf) error {
|
||||
testName := "IAMListAccessKeys_non_existing_user"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
userName := "non-existing-" + genRandString(16)
|
||||
_, err := listIAMAccessKeys(client, &iam.ListAccessKeysInput{UserName: &userName})
|
||||
return checkIAMApiErr(err, iamerr.NoSuchEntityUser(userName))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMListAccessKeys_empty_result(s *S3Conf) error {
|
||||
testName := "IAMListAccessKeys_empty_result"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
userName := newIAMUserName()
|
||||
if _, err := createIAMUser(client, &iam.CreateUserInput{UserName: &userName}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
checkErr := func() error {
|
||||
out, err := listIAMAccessKeys(client, &iam.ListAccessKeysInput{UserName: &userName})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if err := checkIAMListAccessKeysOutput(out); err != nil {
|
||||
return err
|
||||
}
|
||||
if len(out.AccessKeyMetadata) != 0 {
|
||||
return fmt.Errorf("expected no access keys, instead got %d", len(out.AccessKeyMetadata))
|
||||
}
|
||||
if out.IsTruncated {
|
||||
return fmt.Errorf("expected IsTruncated to be false")
|
||||
}
|
||||
return nil
|
||||
}()
|
||||
|
||||
deleteErr := deleteIAMUser(client, userName)
|
||||
if checkErr != nil {
|
||||
return checkErr
|
||||
}
|
||||
return deleteErr
|
||||
})
|
||||
}
|
||||
|
||||
func IAMListAccessKeys_success(s *S3Conf) error {
|
||||
testName := "IAMListAccessKeys_success"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
userName := newIAMUserName()
|
||||
if _, err := createIAMUser(client, &iam.CreateUserInput{UserName: &userName}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
checkErr := func() error {
|
||||
expected := map[string]iamtypes.StatusType{}
|
||||
for range 2 {
|
||||
created, err := createIAMAccessKey(client, &iam.CreateAccessKeyInput{UserName: &userName})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
expected[aws.ToString(created.AccessKey.AccessKeyId)] = iamtypes.StatusTypeActive
|
||||
}
|
||||
|
||||
first, err := listIAMAccessKeys(client, &iam.ListAccessKeysInput{UserName: &userName})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
second, err := listIAMAccessKeys(client, &iam.ListAccessKeysInput{UserName: &userName})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if err := checkIAMListAccessKeysOutput(first); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := checkIAMListAccessKeys(first.AccessKeyMetadata, userName, expected); err != nil {
|
||||
return err
|
||||
}
|
||||
if !reflect.DeepEqual(iamListAccessKeyIDs(first.AccessKeyMetadata), iamListAccessKeyIDs(second.AccessKeyMetadata)) {
|
||||
return fmt.Errorf("expected consistent results across calls")
|
||||
}
|
||||
return nil
|
||||
}()
|
||||
|
||||
deleteErr := deleteIAMUserAndAccessKeys(client, userName)
|
||||
if checkErr != nil {
|
||||
return checkErr
|
||||
}
|
||||
return deleteErr
|
||||
})
|
||||
}
|
||||
|
||||
func IAMListAccessKeys_pagination(s *S3Conf) error {
|
||||
testName := "IAMListAccessKeys_pagination"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
userName := newIAMUserName()
|
||||
if _, err := createIAMUser(client, &iam.CreateUserInput{UserName: &userName}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
checkErr := func() error {
|
||||
expected := map[string]iamtypes.StatusType{}
|
||||
for range 2 {
|
||||
created, err := createIAMAccessKey(client, &iam.CreateAccessKeyInput{UserName: &userName})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
expected[aws.ToString(created.AccessKey.AccessKeyId)] = iamtypes.StatusTypeActive
|
||||
}
|
||||
|
||||
input := iam.ListAccessKeysInput{UserName: &userName, MaxItems: aws.Int32(1)}
|
||||
firstPages, err := collectIAMListAccessKeyPages(client, input)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
secondPages, err := collectIAMListAccessKeyPages(client, input)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if len(firstPages) != 2 {
|
||||
return fmt.Errorf("expected 2 pages, instead got %d", len(firstPages))
|
||||
}
|
||||
var allKeys []iamtypes.AccessKeyMetadata
|
||||
for i, page := range firstPages {
|
||||
if len(page.AccessKeyMetadata) != 1 {
|
||||
return fmt.Errorf("expected page %d to contain 1 access key, instead got %d", i+1, len(page.AccessKeyMetadata))
|
||||
}
|
||||
if page.IsTruncated != (i < len(firstPages)-1) {
|
||||
return fmt.Errorf("unexpected IsTruncated value on page %d", i+1)
|
||||
}
|
||||
allKeys = append(allKeys, page.AccessKeyMetadata...)
|
||||
}
|
||||
if err := checkIAMListAccessKeys(allKeys, userName, expected); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
var firstIDs, secondIDs [][]string
|
||||
for _, page := range firstPages {
|
||||
firstIDs = append(firstIDs, append([]string{fmt.Sprint(page.IsTruncated), aws.ToString(page.Marker)}, iamListAccessKeyIDs(page.AccessKeyMetadata)...))
|
||||
}
|
||||
for _, page := range secondPages {
|
||||
secondIDs = append(secondIDs, append([]string{fmt.Sprint(page.IsTruncated), aws.ToString(page.Marker)}, iamListAccessKeyIDs(page.AccessKeyMetadata)...))
|
||||
}
|
||||
if !reflect.DeepEqual(firstIDs, secondIDs) {
|
||||
return fmt.Errorf("expected consistent pagination results")
|
||||
}
|
||||
|
||||
return nil
|
||||
}()
|
||||
|
||||
deleteErr := deleteIAMUserAndAccessKeys(client, userName)
|
||||
if checkErr != nil {
|
||||
return checkErr
|
||||
}
|
||||
return deleteErr
|
||||
})
|
||||
}
|
||||
|
||||
func listIAMAccessKeys(client *iam.Client, input *iam.ListAccessKeysInput) (*iam.ListAccessKeysOutput, error) {
|
||||
ctx, cancel := context.WithTimeout(context.Background(), shortTimeout)
|
||||
defer cancel()
|
||||
return client.ListAccessKeys(ctx, input)
|
||||
}
|
||||
|
||||
func collectIAMListAccessKeyPages(client *iam.Client, input iam.ListAccessKeysInput) ([]*iam.ListAccessKeysOutput, error) {
|
||||
var pages []*iam.ListAccessKeysOutput
|
||||
for {
|
||||
out, err := listIAMAccessKeys(client, &input)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if err := checkIAMListAccessKeysOutput(out); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
pages = append(pages, out)
|
||||
if !out.IsTruncated {
|
||||
return pages, nil
|
||||
}
|
||||
input.Marker = out.Marker
|
||||
}
|
||||
}
|
||||
|
||||
func checkIAMListAccessKeysOutput(out *iam.ListAccessKeysOutput) error {
|
||||
if out == nil {
|
||||
return fmt.Errorf("expected ListAccessKeys output")
|
||||
}
|
||||
if requestID, ok := awsmiddleware.GetRequestIDMetadata(out.ResultMetadata); !ok || requestID == "" {
|
||||
return fmt.Errorf("expected ListAccessKeys response request id")
|
||||
}
|
||||
if out.IsTruncated != (out.Marker != nil && aws.ToString(out.Marker) != "") {
|
||||
return fmt.Errorf("expected marker only when ListAccessKeys output is truncated")
|
||||
}
|
||||
for _, key := range out.AccessKeyMetadata {
|
||||
if aws.ToString(key.UserName) == "" || aws.ToString(key.AccessKeyId) == "" || key.CreateDate == nil || key.CreateDate.IsZero() {
|
||||
return fmt.Errorf("expected all required fields for listed access key, instead got %#v", key)
|
||||
}
|
||||
if !integrationIAMAccessKeyIDPattern.MatchString(aws.ToString(key.AccessKeyId)) {
|
||||
return fmt.Errorf("expected AWS IAM access key id, instead got %q", aws.ToString(key.AccessKeyId))
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func checkIAMListAccessKeys(keys []iamtypes.AccessKeyMetadata, userName string, expected map[string]iamtypes.StatusType) error {
|
||||
if len(keys) != len(expected) {
|
||||
return fmt.Errorf("expected %d access keys, instead got %d: %v", len(expected), len(keys), iamListAccessKeyIDs(keys))
|
||||
}
|
||||
ids := iamListAccessKeyIDs(keys)
|
||||
if !sort.StringsAreSorted(ids) {
|
||||
return fmt.Errorf("expected access keys sorted by access key id, instead got %v", ids)
|
||||
}
|
||||
for _, key := range keys {
|
||||
id := aws.ToString(key.AccessKeyId)
|
||||
status, ok := expected[id]
|
||||
if !ok {
|
||||
return fmt.Errorf("unexpected listed access key %q", id)
|
||||
}
|
||||
if aws.ToString(key.UserName) != userName {
|
||||
return fmt.Errorf("expected access key %q user name %q, instead got %q", id, userName, aws.ToString(key.UserName))
|
||||
}
|
||||
if key.Status != status {
|
||||
return fmt.Errorf("expected access key %q status %q, instead got %q", id, status, key.Status)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func iamListAccessKeyIDs(keys []iamtypes.AccessKeyMetadata) []string {
|
||||
ids := make([]string, len(keys))
|
||||
for i, key := range keys {
|
||||
ids[i] = aws.ToString(key.AccessKeyId)
|
||||
}
|
||||
return ids
|
||||
}
|
||||
@@ -0,0 +1,254 @@
|
||||
// Copyright 2026 Versity Software
|
||||
// This file is licensed under the Apache License, Version 2.0
|
||||
// (the "License"); you may not use this file except in compliance
|
||||
// with the License. You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing,
|
||||
// software distributed under the License is distributed on an
|
||||
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
||||
// KIND, either express or implied. See the License for the
|
||||
// specific language governing permissions and limitations
|
||||
// under the License.
|
||||
|
||||
package integration
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/aws/aws-sdk-go-v2/aws"
|
||||
awsmiddleware "github.com/aws/aws-sdk-go-v2/aws/middleware"
|
||||
"github.com/aws/aws-sdk-go-v2/service/iam"
|
||||
iamtypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
|
||||
"github.com/versity/versitygw/iamapi/iamerr"
|
||||
)
|
||||
|
||||
func IAMUpdateAccessKey_missing_user_name(s *S3Conf) error {
|
||||
testName := "IAMUpdateAccessKey_missing_user_name"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
_, err := updateIAMAccessKey(client, &iam.UpdateAccessKeyInput{
|
||||
AccessKeyId: aws.String(genRandString(20)),
|
||||
Status: iamtypes.StatusTypeActive,
|
||||
})
|
||||
return checkIAMApiErr(err, iamerr.MissingParameter("UserName"))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMUpdateAccessKey_invalid_user_name(s *S3Conf) error {
|
||||
testName := "IAMUpdateAccessKey_invalid_user_name"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
_, err := updateIAMAccessKey(client, &iam.UpdateAccessKeyInput{
|
||||
UserName: aws.String("invalid/user"),
|
||||
AccessKeyId: aws.String(genRandString(20)),
|
||||
Status: iamtypes.StatusTypeActive,
|
||||
})
|
||||
return checkIAMApiErr(err, iamerr.InvalidUserName("userName"))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMUpdateAccessKey_long_user_name(s *S3Conf) error {
|
||||
testName := "IAMUpdateAccessKey_long_user_name"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
_, err := updateIAMAccessKey(client, &iam.UpdateAccessKeyInput{
|
||||
UserName: aws.String(strings.Repeat("a", 129)),
|
||||
AccessKeyId: aws.String(genRandString(20)),
|
||||
Status: iamtypes.StatusTypeActive,
|
||||
})
|
||||
return checkIAMApiErr(err, iamerr.UserNameTooLong("userName", 128))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMUpdateAccessKey_missing_access_key_id(s *S3Conf) error {
|
||||
testName := "IAMUpdateAccessKey_missing_access_key_id"
|
||||
body := []byte(url.Values{
|
||||
"Action": {"UpdateAccessKey"},
|
||||
"Version": {"2010-05-08"},
|
||||
"UserName": {"validusername"},
|
||||
"Status": {"Active"},
|
||||
}.Encode())
|
||||
return authHandler(s, &authConfig{
|
||||
testName: testName,
|
||||
method: http.MethodPost,
|
||||
service: "iam",
|
||||
region: iamAuthRegion,
|
||||
body: body,
|
||||
date: time.Now().UTC(),
|
||||
headers: map[string]string{
|
||||
"Content-Type": "application/x-www-form-urlencoded",
|
||||
},
|
||||
}, func(req *http.Request) error {
|
||||
return checkIAMAuthRequest(s, req, iamerr.MissingParameter("AccessKeyId"))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMUpdateAccessKey_access_key_id_too_short(s *S3Conf) error {
|
||||
testName := "IAMUpdateAccessKey_access_key_id_too_short"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
_, err := updateIAMAccessKey(client, &iam.UpdateAccessKeyInput{
|
||||
UserName: aws.String("validusername"),
|
||||
AccessKeyId: aws.String(genRandString(15)),
|
||||
Status: iamtypes.StatusTypeActive,
|
||||
})
|
||||
return checkIAMApiErr(err, iamerr.AccessKeyIDTooShort(16))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMUpdateAccessKey_access_key_id_too_long(s *S3Conf) error {
|
||||
testName := "IAMUpdateAccessKey_access_key_id_too_long"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
_, err := updateIAMAccessKey(client, &iam.UpdateAccessKeyInput{
|
||||
UserName: aws.String("validusername"),
|
||||
AccessKeyId: aws.String(genRandString(129)),
|
||||
Status: iamtypes.StatusTypeActive,
|
||||
})
|
||||
return checkIAMApiErr(err, iamerr.AccessKeyIDTooLong(128))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMUpdateAccessKey_invalid_access_key_id_chars(s *S3Conf) error {
|
||||
testName := "IAMUpdateAccessKey_invalid_access_key_id_chars"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
_, err := updateIAMAccessKey(client, &iam.UpdateAccessKeyInput{
|
||||
UserName: aws.String("validusername"),
|
||||
AccessKeyId: aws.String("invalid-key-id-1234"),
|
||||
Status: iamtypes.StatusTypeActive,
|
||||
})
|
||||
return checkIAMApiErr(err, iamerr.GetAPIError(iamerr.ErrInvalidAccessKeyIDChars))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMUpdateAccessKey_missing_status(s *S3Conf) error {
|
||||
testName := "IAMUpdateAccessKey_missing_status"
|
||||
body := []byte(url.Values{
|
||||
"Action": {"UpdateAccessKey"},
|
||||
"Version": {"2010-05-08"},
|
||||
"UserName": {"validusername"},
|
||||
"AccessKeyId": {genRandString(20)},
|
||||
}.Encode())
|
||||
return authHandler(s, &authConfig{
|
||||
testName: testName,
|
||||
method: http.MethodPost,
|
||||
service: "iam",
|
||||
region: iamAuthRegion,
|
||||
body: body,
|
||||
date: time.Now().UTC(),
|
||||
headers: map[string]string{
|
||||
"Content-Type": "application/x-www-form-urlencoded",
|
||||
},
|
||||
}, func(req *http.Request) error {
|
||||
return checkIAMAuthRequest(s, req, iamerr.MissingParameter("Status"))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMUpdateAccessKey_invalid_status(s *S3Conf) error {
|
||||
testName := "IAMUpdateAccessKey_invalid_status"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
_, err := updateIAMAccessKey(client, &iam.UpdateAccessKeyInput{
|
||||
UserName: aws.String("validusername"),
|
||||
AccessKeyId: aws.String(genRandString(20)),
|
||||
Status: iamtypes.StatusType("Bogus"),
|
||||
})
|
||||
return checkIAMApiErr(err, iamerr.InvalidAccessKeyStatus("Bogus"))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMUpdateAccessKey_non_existing_user(s *S3Conf) error {
|
||||
testName := "IAMUpdateAccessKey_non_existing_user"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
userName := "non-existing-" + genRandString(16)
|
||||
_, err := updateIAMAccessKey(client, &iam.UpdateAccessKeyInput{
|
||||
UserName: &userName,
|
||||
AccessKeyId: aws.String(genRandString(20)),
|
||||
Status: iamtypes.StatusTypeActive,
|
||||
})
|
||||
return checkIAMApiErr(err, iamerr.NoSuchEntityUser(userName))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMUpdateAccessKey_non_existing_access_key(s *S3Conf) error {
|
||||
testName := "IAMUpdateAccessKey_non_existing_access_key"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
userName := newIAMUserName()
|
||||
if _, err := createIAMUser(client, &iam.CreateUserInput{UserName: &userName}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
accessKeyID := genRandString(20)
|
||||
_, updateErr := updateIAMAccessKey(client, &iam.UpdateAccessKeyInput{
|
||||
UserName: &userName,
|
||||
AccessKeyId: &accessKeyID,
|
||||
Status: iamtypes.StatusTypeActive,
|
||||
})
|
||||
checkErr := checkIAMApiErr(updateErr, iamerr.NoSuchEntityAccessKey(accessKeyID))
|
||||
|
||||
deleteErr := deleteIAMUser(client, userName)
|
||||
if checkErr != nil {
|
||||
return checkErr
|
||||
}
|
||||
return deleteErr
|
||||
})
|
||||
}
|
||||
|
||||
func IAMUpdateAccessKey_success(s *S3Conf) error {
|
||||
testName := "IAMUpdateAccessKey_success"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
userName := newIAMUserName()
|
||||
if _, err := createIAMUser(client, &iam.CreateUserInput{UserName: &userName}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
checkErr := func() error {
|
||||
created, err := createIAMAccessKey(client, &iam.CreateAccessKeyInput{UserName: &userName})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
accessKeyID := aws.ToString(created.AccessKey.AccessKeyId)
|
||||
|
||||
out, err := updateIAMAccessKey(client, &iam.UpdateAccessKeyInput{
|
||||
UserName: &userName,
|
||||
AccessKeyId: &accessKeyID,
|
||||
Status: iamtypes.StatusTypeInactive,
|
||||
})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if out == nil {
|
||||
return fmt.Errorf("expected UpdateAccessKey output")
|
||||
}
|
||||
if requestID, ok := awsmiddleware.GetRequestIDMetadata(out.ResultMetadata); !ok || requestID == "" {
|
||||
return fmt.Errorf("expected UpdateAccessKey response request id")
|
||||
}
|
||||
|
||||
listOut, err := listIAMAccessKeys(client, &iam.ListAccessKeysInput{UserName: &userName})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if len(listOut.AccessKeyMetadata) != 1 {
|
||||
return fmt.Errorf("expected 1 access key, instead got %d", len(listOut.AccessKeyMetadata))
|
||||
}
|
||||
if listOut.AccessKeyMetadata[0].Status != iamtypes.StatusTypeInactive {
|
||||
return fmt.Errorf("expected access key status to be %q, instead got %q", iamtypes.StatusTypeInactive, listOut.AccessKeyMetadata[0].Status)
|
||||
}
|
||||
|
||||
return nil
|
||||
}()
|
||||
|
||||
deleteErr := deleteIAMUserAndAccessKeys(client, userName)
|
||||
if checkErr != nil {
|
||||
return checkErr
|
||||
}
|
||||
return deleteErr
|
||||
})
|
||||
}
|
||||
|
||||
func updateIAMAccessKey(client *iam.Client, input *iam.UpdateAccessKeyInput) (*iam.UpdateAccessKeyOutput, error) {
|
||||
ctx, cancel := context.WithTimeout(context.Background(), shortTimeout)
|
||||
defer cancel()
|
||||
return client.UpdateAccessKey(ctx, input)
|
||||
}
|
||||
Reference in New Issue
Block a user