mirror of
https://github.com/versity/versitygw.git
synced 2026-08-16 12:16:14 +00:00
317 lines
10 KiB
Bash
317 lines
10 KiB
Bash
#!/usr/bin/env bats
|
|
|
|
# Copyright 2026 Versity Software
|
|
# This file is licensed under the Apache License, Version 2.0
|
|
# (the "License"); you may not use this file except in compliance
|
|
# with the License. You may obtain a copy of the License at
|
|
#
|
|
# http:#www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing,
|
|
# software distributed under the License is distributed on an
|
|
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
# KIND, either express or implied. See the License for the
|
|
# specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
get_cloudfront_config() {
|
|
if ! check_param_count_v2 "bucket name, root object, website endpoint" 3 $#; then
|
|
return 1
|
|
fi
|
|
local bucket="$1" root_object="$2" website_endpoint="$3"
|
|
local response file_name
|
|
|
|
if ! response=$(get_file_name 2>&1); then
|
|
log 2 "error getting file name: $response"
|
|
return 1
|
|
fi
|
|
file_name="$response"
|
|
|
|
cat > "$TEST_FILE_FOLDER/$file_name" <<EOF
|
|
{
|
|
"CallerReference": "$(date +%s)",
|
|
"Comment": "HTTPS distribution for ${bucket}",
|
|
"Enabled": true,
|
|
"DefaultRootObject": "${root_object}",
|
|
"Origins": {
|
|
"Quantity": 1,
|
|
"Items": [
|
|
{
|
|
"Id": "s3-website-origin",
|
|
"DomainName": "${website_endpoint}",
|
|
"CustomOriginConfig": {
|
|
"HTTPPort": 80,
|
|
"HTTPSPort": 443,
|
|
"OriginProtocolPolicy": "http-only",
|
|
"OriginSslProtocols": {
|
|
"Quantity": 1,
|
|
"Items": ["TLSv1.2"]
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"DefaultCacheBehavior": {
|
|
"TargetOriginId": "s3-website-origin",
|
|
"ViewerProtocolPolicy": "redirect-to-https",
|
|
"AllowedMethods": {
|
|
"Quantity": 2,
|
|
"Items": ["GET", "HEAD"],
|
|
"CachedMethods": {
|
|
"Quantity": 2,
|
|
"Items": ["GET", "HEAD"]
|
|
}
|
|
},
|
|
"Compress": true,
|
|
"CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6"
|
|
},
|
|
"PriceClass": "PriceClass_100",
|
|
"HttpVersion": "http2",
|
|
"IsIPV6Enabled": true
|
|
}
|
|
EOF
|
|
|
|
printf '%s\n' "$TEST_FILE_FOLDER/$file_name"
|
|
return 0
|
|
}
|
|
|
|
create_cloudfront_distribution() {
|
|
if ! check_param_count_v2 "bucket name, root object, website endpoint" 3 $#; then
|
|
return 1
|
|
fi
|
|
if [ -z "$DIRECT_CLOUDFRONT_TAG" ]; then
|
|
log 2 "adding a cloudfront distribution in S3 test mode requires DIRECT_CLOUDFRONT_TAG env param to be set"
|
|
return 1
|
|
fi
|
|
local bucket_name="$1" root_object="$2" website_endpoint="$3"
|
|
local response config_file distribution_id distribution_domain
|
|
|
|
if ! response=$(get_cloudfront_config "$bucket_name" "$root_object" "$website_endpoint" 2>&1); then
|
|
log 2 "error getting cloudfront config file: $response"
|
|
return 1
|
|
fi
|
|
config_file="$response"
|
|
|
|
if ! response=$(put_cloudfront_user_policy 2>&1); then
|
|
log 2 "error putting cloudfront user policy: $response"
|
|
return 1
|
|
fi
|
|
|
|
if ! response=$(send_command env AWS_IGNORE_CONFIGURED_ENDPOINT_URLS=true aws cloudfront create-distribution \
|
|
--distribution-config "file://${config_file}" --query 'Distribution.[Id,DomainName]' --output text 2>&1); then
|
|
log 2 "error creating distribution: $response"
|
|
return 1
|
|
fi
|
|
read -r distribution_id distribution_domain <<< "$response"
|
|
|
|
if ! response=$(send_command env AWS_IGNORE_CONFIGURED_ENDPOINT_URLS=true aws cloudfront wait distribution-deployed --id "$distribution_id" 2>&1); then
|
|
log 2 "error waiting for distribution to deploy: $response"
|
|
return 1
|
|
fi
|
|
|
|
if ! response=$(send_command env AWS_IGNORE_CONFIGURED_ENDPOINT_URLS=true aws cloudfront tag-resource \
|
|
--resource "arn:aws:cloudfront::${DIRECT_AWS_USER_ID}:distribution/${distribution_id}" \
|
|
--tags 'Items=[{Key=Versitygw-Test,Value='"${DIRECT_CLOUDFRONT_TAG}"'}]' 2>&1); then
|
|
log 2 "error tagging new distribution: $response"
|
|
return 1
|
|
fi
|
|
|
|
printf '%s\n' "https://${distribution_domain}"
|
|
return 0
|
|
}
|
|
|
|
put_cloudfront_user_policy() {
|
|
log 6 "put_cloudfront_user_policy"
|
|
local response file_name
|
|
|
|
if ! response=$(get_file_name 2>&1); then
|
|
log 2 "error getting file name: $response"
|
|
return 1
|
|
fi
|
|
file_name="$response"
|
|
|
|
cat > "$TEST_FILE_FOLDER/$file_name" <<EOF
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Sid": "CreateCloudFrontDistribution",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"cloudfront:CreateDistribution",
|
|
"cloudfront:DeleteDistribution",
|
|
"cloudfront:GetDistribution",
|
|
"cloudfront:GetDistributionConfig",
|
|
"cloudfront:ListDistributions",
|
|
"cloudfront:ListTagsForResource",
|
|
"cloudtrail:LookupEvents",
|
|
"cloudfront:TagResource",
|
|
"cloudfront:UpdateDistribution"
|
|
],
|
|
"Resource": "*"
|
|
}
|
|
]
|
|
}
|
|
EOF
|
|
|
|
if ! response=$(send_command env AWS_IGNORE_CONFIGURED_ENDPOINT_URLS=true aws iam put-user-policy \
|
|
--user-name "$USER_ID_USER_1" --policy-name AllowCloudFrontTesting --policy-document "file://${TEST_FILE_FOLDER}/${file_name}" 2>&1); then
|
|
log 2 "error putting user policy: $response"
|
|
return 1
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
delete_tester_created_distributions() {
|
|
log 6 "get_user_created_distribution_ids"
|
|
if ! check_param_count_v2 "s3 username" 1 $#; then
|
|
return 1
|
|
fi
|
|
local username="$1"
|
|
local response cloudtrail_data distribution_ids
|
|
local -a distribution_id_array=()
|
|
|
|
if ! response=$(send_command env AWS_IGNORE_CONFIGURED_ENDPOINT_URLS=true aws cloudtrail lookup-events \
|
|
--region us-east-1 --lookup-attributes AttributeKey=Username,AttributeValue="${username}" --query 'Events[].CloudTrailEvent' --output text 2>&1); then
|
|
log 2 "error getting distribution ids: $response"
|
|
return 1
|
|
fi
|
|
cloudtrail_data="$response"
|
|
|
|
if [ -n "$cloudtrail_data" ]; then
|
|
return 0
|
|
fi
|
|
|
|
distribution_ids=$(jq -r -s '
|
|
.[] | select(. != null) | try fromjson catch null
|
|
| select(. != null and .eventSource == "cloudfront.amazonaws.com")
|
|
| select(.eventName == "CreateDistribution" or .eventName == "CreateDistributionWithTags")
|
|
| .responseElements.distribution.id
|
|
' <<< "$cloudtrail_data" 2>&1)
|
|
log 5 "distribution ids: $distribution_ids"
|
|
|
|
mapfile -t distribution_id_array <<< "$distribution_ids"
|
|
for id in "${distribution_id_array[@]}"; do
|
|
if ! delete_cloudfront_distribution "$id"; then
|
|
log 2 "error deleting distribution"
|
|
return 1
|
|
fi
|
|
done
|
|
return 0
|
|
}
|
|
|
|
disable_cloudfront_distribution() {
|
|
if ! check_param_count_v2 "config JSON, distribution ID, etag" 3 $#; then
|
|
return 1
|
|
fi
|
|
local config_json="$1" distribution_id="$2" etag="$3"
|
|
local response config_with_disable
|
|
|
|
if ! response=$(get_file_name 2>&1); then
|
|
log 2 "error getting file name: $response"
|
|
return 1
|
|
fi
|
|
config_with_disable="$TEST_FILE_FOLDER/$response"
|
|
|
|
if ! response=$(jq '.DistributionConfig.Enabled = false | .DistributionConfig' <<< "$config_json" > "$config_with_disable" 2>&1); then
|
|
log 2 "error locally writing new config with Enabled set to false: $response"
|
|
return 1
|
|
fi
|
|
|
|
if ! response=$(send_command env AWS_IGNORE_CONFIGURED_ENDPOINT_URLS=true aws cloudfront update-distribution \
|
|
--id "$distribution_id" --if-match "$etag" --distribution-config "file://${config_with_disable}" 2>&1); then
|
|
log 2 "error updating distribution config: $response"
|
|
return 1
|
|
fi
|
|
|
|
if ! response=$(send_command env AWS_IGNORE_CONFIGURED_ENDPOINT_URLS=true aws cloudfront wait distribution-deployed \
|
|
--id "$distribution_id" 2>&1); then
|
|
log 2 "error waiting for distribution disability: $response"
|
|
return 1
|
|
fi
|
|
|
|
if ! response=$(send_command env AWS_IGNORE_CONFIGURED_ENDPOINT_URLS=true aws cloudfront get-distribution-config \
|
|
--id "$distribution_id" --query ETag --output text 2>&1); then
|
|
log 2 "error getting delete etag: $response"
|
|
return 1
|
|
fi
|
|
etag="$response"
|
|
echo "$etag"
|
|
return 0
|
|
}
|
|
|
|
# return 2 for error, 1 for no match, 0 for match
|
|
check_for_cloudfront_tag() {
|
|
if ! check_param_count_v2 "distribution ID" 1 $#; then
|
|
return 2
|
|
fi
|
|
local distribution_id="$1"
|
|
local distribution_arn response tag_value
|
|
|
|
distribution_arn="arn:aws:cloudfront::${DIRECT_AWS_USER_ID}:distribution/${distribution_id}"
|
|
if ! response=$(send_command env AWS_IGNORE_CONFIGURED_ENDPOINT_URLS=true aws cloudfront list-tags-for-resource \
|
|
--resource "$distribution_arn" \
|
|
--query "Tags.Items[?Key=='Versitygw-Test' && Value=='${DIRECT_CLOUDFRONT_TAG}'].Value | [0]" \
|
|
--output text 2>&1); then
|
|
log 2 "error checking tag: $response"
|
|
return 2
|
|
fi
|
|
tag_value="$response"
|
|
|
|
if [ "$tag_value" != "$DIRECT_CLOUDFRONT_TAG" ]; then
|
|
log 5 "skipping distribution with ID '${distribution_id}' (not tagged '$DIRECT_CLOUDFRONT_TAG')"
|
|
return 1
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
delete_cloudfront_distribution() {
|
|
log 6 "delete_cloudfront_distribution: '$1'"
|
|
if ! check_param_count_v2 "distribution ID" 1 $#; then
|
|
return 1
|
|
fi
|
|
local distribution_id="$1"
|
|
local response config_json enabled etag tag_check_result=0 config_with_disable deletion_etag
|
|
|
|
if [ -z "$distribution_id" ] || [ "$distribution_id" == "null" ]; then
|
|
return 0
|
|
fi
|
|
if ! response="$(env AWS_IGNORE_CONFIGURED_ENDPOINT_URLS=true aws cloudfront get-distribution-config --id "$distribution_id" 2>&1)"; then
|
|
if [[ "$response" == *"The specified distribution does not exist"* ]]; then
|
|
return 0
|
|
fi
|
|
log 2 "error getting config for distribution with ID '$distribution_id': $response"
|
|
return 1
|
|
fi
|
|
config_json="$response"
|
|
enabled="$(jq -r '.DistributionConfig.Enabled' <<< "$config_json")"
|
|
etag="$(jq -r '.ETag' <<< "$config_json")"
|
|
|
|
check_for_cloudfront_tag "$distribution_id" || tag_check_result=$?
|
|
if [ "$tag_check_result" -eq 2 ]; then
|
|
log 2 "error checking for cloudfront tag"
|
|
return 1
|
|
elif [ "$tag_check_result" -eq 1 ]; then
|
|
return 0
|
|
fi
|
|
|
|
if [ "$enabled" == "true" ]; then
|
|
if ! response=$(disable_cloudfront_distribution "$config_json" "$distribution_id" "$etag" 2>&1); then
|
|
log 2 "error deleting cloudfront distribution with id '$distribution_id': $response"
|
|
return 1
|
|
fi
|
|
deletion_etag="$response"
|
|
else
|
|
deletion_etag="$etag"
|
|
fi
|
|
|
|
if ! response=$(send_command env AWS_IGNORE_CONFIGURED_ENDPOINT_URLS=true aws cloudfront delete-distribution \
|
|
--id "$distribution_id" --if-match "$deletion_etag" 2>&1); then
|
|
log 2 "error deleting distribution: $response"
|
|
return 1
|
|
fi
|
|
|
|
log 5 "Deleted $distribution_id"
|
|
return 0
|
|
}
|