kumogata-template 0.0.35 → 0.0.36

data/test/iam_test.rb

@@ -2,57 +2,6 @@ require 'abstract_unit'
 require 'kumogata/template/iam'
 
 class IamTest < Minitest::Test
-  def test_iam_to_policy_condition
-    template = <<-EOS
-condition = { "=": [ "s3:x-amz-acl", "bucket-owner-full-control" ] }
-Test _iam_to_policy_condition(condition)
-    EOS
-    act_template = run_client_as_json(template)
-    exp_template = <<-EOS
-{
-  "Test": {
-    "StringEquals": {
-      "s3:x-amz-acl": "bucket-owner-full-control"
-    }
-  }
-}
-    EOS
-    assert_equal exp_template.chomp, act_template
-
-    template = <<-EOS
-condition = {
-  "=": [ "aws:UserAgent", "Example Corp Java Client" ],
-  "date greater than": [ "aws:CurrentTime", "2013-08-16T12:00:00Z" ],
-  "numeric less than equals": [ "s3:max-keys", "10" ],
-  "ip address": [ "aws:SourceIp", ["192.0.2.0/24", "203.0.113.0/24"] ],
-}
-Test _iam_to_policy_condition(condition)
-    EOS
-    act_template = run_client_as_json(template)
-    exp_template = <<-EOS
-{
-  "Test": {
-    "StringEquals": {
-      "aws:UserAgent": "Example Corp Java Client"
-    },
-    "DateGreaterThan": {
-      "aws:CurrentTime": "2013-08-16T12:00:00Z"
-    },
-    "NumericLessThanEquals": {
-      "s3:max-keys": "10"
-    },
-    "IpAddress": {
-      "aws:SourceIp": [
-        "192.0.2.0/24",
-        "203.0.113.0/24"
-      ]
-    }
-  }
-}
-    EOS
-    assert_equal exp_template.chomp, act_template
-  end
-
   def test_iam_policies
     template = <<-EOS
 Policies _iam_policies "test", test: [ { document: [ { service: "s3" } ] } ]
@@ -76,7 +25,17 @@ Policies _iam_policies "test", test: [ { document: [ { service: "s3" } ] } ]
           }
         ]
       },
-      "PolicyName": "Policy0"
+      "PolicyName": {
+        "Fn::Join": [
+          "-",
+          [
+            {
+              "Ref": "Service"
+            },
+            "policy-1"
+          ]
+        ]
+      }
     }
   ]
 }
@@ -188,6 +147,114 @@ PolicyDocument _iam_policy_document "test", test: [ { service: "s3" } ]
     EOS
     assert_equal exp_template.chomp, act_template
 
+    template = <<-EOS
+PolicyDocument _iam_policy_document "test", test: [ { service: "s3", action: "put object" } ]
+    EOS
+    act_template = run_client_as_json(template)
+    exp_template = <<-EOS
+{
+  "PolicyDocument": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "s3:PutObject"
+      ],
+      "Resource": [
+        "*"
+      ]
+    }
+  ]
+}
+    EOS
+    assert_equal exp_template.chomp, act_template
+
+    template = <<-EOS
+PolicyDocument _iam_policy_document "test", test: [ { service: "s3", action: "PutObject" } ]
+    EOS
+    act_template = run_client_as_json(template)
+    exp_template = <<-EOS
+{
+  "PolicyDocument": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "s3:PutObject"
+      ],
+      "Resource": [
+        "*"
+      ]
+    }
+  ]
+}
+    EOS
+    assert_equal exp_template.chomp, act_template
+
+    template = <<-EOS
+PolicyDocument _iam_policy_document "test", test: [ { services: [ "s3", "ec2" ] } ]
+    EOS
+    act_template = run_client_as_json(template)
+    exp_template = <<-EOS
+{
+  "PolicyDocument": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "s3:*",
+        "ec2:*"
+      ],
+      "Resource": [
+        "*"
+      ]
+    }
+  ]
+}
+    EOS
+    assert_equal exp_template.chomp, act_template
+
+    template = <<-EOS
+PolicyDocument _iam_policy_document "test", test: [ { service: "s3", actions: [ "get object *", "put object" ] } ]
+    EOS
+    act_template = run_client_as_json(template)
+    exp_template = <<-EOS
+{
+  "PolicyDocument": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "s3:GetObject*",
+        "s3:PutObject"
+      ],
+      "Resource": [
+        "*"
+      ]
+    }
+  ]
+}
+    EOS
+    assert_equal exp_template.chomp, act_template
+
+    template = <<-EOS
+PolicyDocument _iam_policy_document "test", test: [ { service: "s3", actions: [ "GetObject*", "PutObject" ] } ]
+    EOS
+    act_template = run_client_as_json(template)
+    exp_template = <<-EOS
+{
+  "PolicyDocument": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "s3:GetObject*",
+        "s3:PutObject"
+      ],
+      "Resource": [
+        "*"
+      ]
+    }
+  ]
+}
+    EOS
+    assert_equal exp_template.chomp, act_template
+
     template = <<-EOS
 PolicyDocument _iam_policy_document "test", test: [ { service: "s3", sid: "test" } ]
     EOS
@@ -211,7 +278,28 @@ PolicyDocument _iam_policy_document "test", test: [ { service: "s3", sid: "test"
     assert_equal exp_template.chomp, act_template
 
     template = <<-EOS
-condition = { "=": [ "s3:x-amz-acl", "bucket-owner-full-control" ] }
+PolicyDocument _iam_policy_document "test", test: [ { service: "s3", resource: "test" } ]
+    EOS
+    act_template = run_client_as_json(template)
+    exp_template = <<-EOS
+{
+  "PolicyDocument": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "s3:*"
+      ],
+      "Resource": [
+        "arn:aws:s3:::test"
+      ]
+    }
+  ]
+}
+    EOS
+    assert_equal exp_template.chomp, act_template
+
+    template = <<-EOS
+condition = { '=': { 's3:x-amz-acl': "bucket-owner-full-control" } }
 PolicyDocument _iam_policy_document "test", test: [ { service: "s3", sid: "test", condition: condition } ]
     EOS
     act_template = run_client_as_json(template)
@@ -240,6 +328,48 @@ PolicyDocument _iam_policy_document "test", test: [ { service: "s3", sid: "test"
   end
 
   def test_iam_assume_role_policy_document
+    template = <<-EOS
+Statement _iam_assume_role_policy_document({ aws: [ { account_id: 123, root: true } ] })
+    EOS
+    act_template = run_client_as_json(template)
+    exp_template = <<-EOS
+{
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "AWS": "arn:aws:iam::123:root"
+      },
+      "Action": [
+        "sts:AssumeRole"
+      ]
+    }
+  ]
+}
+    EOS
+    assert_equal exp_template.chomp, act_template
+
+    template = <<-EOS
+Statement _iam_assume_role_policy_document({ federated: "test" })
+    EOS
+    act_template = run_client_as_json(template)
+    exp_template = <<-EOS
+{
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "Federated": "test"
+      },
+      "Action": [
+        "sts:AssumeRole"
+      ]
+    }
+  ]
+}
+    EOS
+    assert_equal exp_template.chomp, act_template
+
     template = <<-EOS
 Statement _iam_assume_role_policy_document({ service: "ec2" })
     EOS
@@ -251,7 +381,7 @@ Statement _iam_assume_role_policy_document({ service: "ec2" })
       "Effect": "Allow",
       "Principal": {
         "Service": [
-          "ec2.amazonaws.com"
+          "ec2.#{DOMAIN}"
         ]
       },
       "Action": [
@@ -259,6 +389,35 @@ Statement _iam_assume_role_policy_document({ service: "ec2" })
       ]
     }
   ]
+}
+    EOS
+    assert_equal exp_template.chomp, act_template
+
+    template = <<-EOS
+Statement _iam_assume_role_policy_document({ cognito: true, cond_auds: "test", cond_amr: "test" })
+    EOS
+    act_template = run_client_as_json(template)
+    exp_template = <<-EOS
+{
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "Federated": "cognito-identity.#{DOMAIN}"
+      },
+      "Action": [
+        "sts:AssumeRoleWithWebIdentity"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "cognito-identity.#{DOMAIN}:aud": "test"
+        },
+        "ForAnyValue:StringLike": {
+          "cognito-identity.#{DOMAIN}:amr": "test"
+        }
+      }
+    }
+  ]
 }
     EOS
     assert_equal exp_template.chomp, act_template
@@ -312,7 +471,7 @@ arn _iam_arn("s3", [ "test1", "test2" ])
     assert_equal exp_template.chomp, act_template
 
     template = <<-EOS
-arn _iam_arn("s3", [ { ref: "test" }, { ref_account: true }, "/*" ])
+arn _iam_arn("s3", [ { ref: "test" }, { ref_account_id: true }, "/*" ])
     EOS
     act_template = run_client_as_json(template)
     exp_template = <<-EOS
@@ -337,8 +496,8 @@ arn _iam_arn("s3", [ { ref: "test" }, { ref_account: true }, "/*" ])
     assert_equal exp_template.chomp, act_template
 
     template = <<-EOS
-test1 = [ { ref: "test1" }, { ref_account: true }, "/*" ]
-test2 = [ { ref: "test2" }, { ref_account: true }, "/*" ]
+test1 = [ { ref: "test1" }, { ref_account_id: true }, "/*" ]
+test2 = [ { ref: "test2" }, { ref_account_id: true }, "/*" ]
 arn _iam_arn("s3", [ test1, test2 ])
     EOS
     act_template = run_client_as_json(template)
@@ -376,6 +535,129 @@ arn _iam_arn("s3", [ test1, test2 ])
       ]
     }
   ]
+}
+  EOS
+    assert_equal exp_template.chomp, act_template
+
+    template = <<-EOS
+arn _iam_arn("apigateway", { path: "teste:testp/tests" })
+    EOS
+    act_template = run_client_as_json(template)
+    exp_template = <<-EOS
+{
+  "arn": {
+    "Fn::Sub": "arn:aws:apigateway:${AWS::Region}::teste:testp/tests"
+  }
+}
+  EOS
+    assert_equal exp_template.chomp, act_template
+
+    template = <<-EOS
+arn _iam_arn("execute-api", { id: "test" })
+    EOS
+    act_template = run_client_as_json(template)
+    exp_template = <<-EOS
+{
+  "arn": {
+    "Fn::Sub": "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:test/*/*/*"
+  }
+}
+  EOS
+    assert_equal exp_template.chomp, act_template
+
+    template = <<-EOS
+arn _iam_arn("execute-api", { id: "test", region: "testr", account_id: "testa" })
+    EOS
+    act_template = run_client_as_json(template)
+    exp_template = <<-EOS
+{
+  "arn": "arn:aws:execute-api:testr:testa:test/*/*/*"
+}
+  EOS
+    assert_equal exp_template.chomp, act_template
+  end
+
+  def test_iam_arn_resource
+    template = <<-EOS
+arn _iam_arn_resource("arn:aws:s3", [ "test" ])
+    EOS
+    act_template = run_client_as_json(template)
+    exp_template = <<-EOS
+{
+  "arn": {
+    "Fn::Sub": "arn:aws:s3:${AWS::Region}:${AWS::AccountId}:test"
+  }
+}
+  EOS
+    assert_equal exp_template.chomp, act_template
+
+    template = <<-EOS
+arn _iam_arn_resource("arn:aws:s3", { account_id: "testa", region: "testr", value: "test" })
+    EOS
+    act_template = run_client_as_json(template)
+    exp_template = <<-EOS
+{
+  "arn": "arn:aws:s3:testr:testa:test"
+}
+  EOS
+    assert_equal exp_template.chomp, act_template
+
+    template = <<-EOS
+arn _iam_arn_resource("arn:aws:s3", { account_id: "testa", region: false, value: "test" })
+    EOS
+    act_template = run_client_as_json(template)
+    exp_template = <<-EOS
+{
+  "arn": "arn:aws:s3::testa:test"
+}
+  EOS
+    assert_equal exp_template.chomp, act_template
+
+    template = <<-EOS
+values = [ "*/", { ref_: "test" }, "/*" ]
+arn _iam_arn_resource("arn:aws:s3", { account_id: false, region: "testr", values: values })
+    EOS
+    act_template = run_client_as_json(template)
+    exp_template = <<-EOS
+{
+  "arn": {
+    "Fn::Join": [
+      "",
+      [
+        "arn:aws:s3:testr::",
+        "*/",
+        {
+          "Ref": "Test"
+        },
+        "/*"
+      ]
+    ]
+  }
+}
+  EOS
+    assert_equal exp_template.chomp, act_template
+
+    template = <<-EOS
+values = [ { import_: "test" }, "/*/*" ]
+arn _iam_arn_resource("arn:aws:s3", { account_id: false, region: "testr", values: values })
+    EOS
+    act_template = run_client_as_json(template)
+    exp_template = <<-EOS
+{
+  "arn": {
+    "Fn::Join": [
+      "",
+      [
+        "arn:aws:s3:testr::",
+        {
+          "Fn::ImportValue": {
+            "Fn::Sub": "test"
+          }
+        },
+        "/*/*"
+      ]
+    ]
+  }
 }
   EOS
     assert_equal exp_template.chomp, act_template
@@ -407,6 +689,239 @@ managed _iam_managed_policies(managed_policies: %w( admin ))
   "managed": [
     "arn:aws:iam::aws:policy/AdministratorAccess"
   ]
+}
+  EOS
+    assert_equal exp_template.chomp, act_template
+  end
+
+  def test_iam_policy_conditions
+    # {"StringEquals": {"aws:UserAgent": "Example Corp Java Client"}}
+    template = <<-EOS
+conds = [
+  { '=': { 'aws:UserAgent': 'Example Corp Java Client' } },
+]
+Condition _iam_policy_conditions(conds)
+    EOS
+    act_template = run_client_as_json(template)
+    exp_template = <<-EOS
+{
+  "Condition": {
+    "StringEquals": {
+      "aws:UserAgent": "Example Corp Java Client"
+    }
+  }
+}
+  EOS
+    assert_equal exp_template.chomp, act_template
+
+    # {"StringLike": {"s3:prefix": [
+    #    "",
+    #    "home/",
+    #    "home/${aws:username}/"
+    #  ]}}
+    template = <<-EOS
+conds = [
+  { '=~': { 's3:prefix': [ "", "home/", "home/${aws:username}/" ] } }
+]
+Condition _iam_policy_conditions(conds)
+    EOS
+    act_template = run_client_as_json(template)
+    exp_template = <<-EOS
+{
+  "Condition": {
+    "StringLike": {
+      "s3:prefix": [
+        "",
+        "home/",
+        "home/${aws:username}/"
+      ]
+    }
+  }
+}
+  EOS
+    assert_equal exp_template.chomp, act_template
+
+    # {"NumericLessThanEquals": {"s3:max-keys": "10"}}
+    template = <<-EOS
+conds = [
+  { '<=': { 's3:max-keys': 10 } }
+]
+Condition _iam_policy_conditions(conds)
+    EOS
+    act_template = run_client_as_json(template)
+    exp_template = <<-EOS
+{
+  "Condition": {
+    "NumericLessThanEquals": {
+      "s3:max-keys": "10"
+    }
+  }
+}
+  EOS
+    assert_equal exp_template.chomp, act_template
+
+    # {"DateLessThan": {"aws:CurrentTime": "2013-06-30T00:00:00Z"}}
+    template = <<-EOS
+conds = [
+  { '<': { type: 'date', 'aws:CurrentTime': '2013-06-30T00:00:00Z' } }
+]
+Condition _iam_policy_conditions(conds)
+    EOS
+    act_template = run_client_as_json(template)
+    exp_template = <<-EOS
+{
+  "Condition": {
+    "DateLessThan": {
+      "aws:CurrentTime": "2013-06-30T00:00:00Z"
+    }
+  }
+}
+  EOS
+    assert_equal exp_template.chomp, act_template
+
+    # {"Bool": {"aws:SecureTransport": "true"}}
+    template = <<-EOS
+conds = [
+  { '=': { 'aws:SecureTransport': true } }
+]
+Condition _iam_policy_conditions(conds)
+    EOS
+    act_template = run_client_as_json(template)
+    exp_template = <<-EOS
+{
+  "Condition": {
+    "Bool": {
+      "aws:SecureTransport": "true"
+    }
+  }
+}
+  EOS
+    assert_equal exp_template.chomp, act_template
+
+    # "BinaryEquals": { "key" : "QmluYXJ5VmFsdWVJbkJhc2U2NA==" }
+    template = <<-EOS
+conds = [
+  { '=': { type: 'bin', 'key': 'QmluYXJ5VmFsdWVJbkJhc2U2NA==' } }
+]
+Condition _iam_policy_conditions(conds)
+    EOS
+    act_template = run_client_as_json(template)
+    exp_template = <<-EOS
+{
+  "Condition": {
+    "BinaryEquals": {
+      "key": "QmluYXJ5VmFsdWVJbkJhc2U2NA=="
+    }
+  }
+}
+  EOS
+    assert_equal exp_template.chomp, act_template
+
+    # {"IpAddress": {"aws:SourceIp": "203.0.113.0/24"}}
+    template = <<-EOS
+conds = [
+  { '=': { type: 'ip', 'aws:SourceType': '203.0.113.0/24' } }
+]
+Condition _iam_policy_conditions(conds)
+    EOS
+    act_template = run_client_as_json(template)
+    exp_template = <<-EOS
+{
+  "Condition": {
+    "IpAddress": {
+      "aws:SourceType": "203.0.113.0/24"
+    }
+  }
+}
+  EOS
+    assert_equal exp_template.chomp, act_template
+
+    # {"ArnEquals": {"aws:SourceArn": "arn:aws:sns:REGION:123456789012:TOPIC-ID"}}
+    template = <<-EOS
+conds = [
+  { '=': { type: 'arn', 'aws:SourceArn': 'arn:aws:sns:REGION:123456789012:TOPIC-ID' } }
+]
+Condition _iam_policy_conditions(conds)
+    EOS
+    act_template = run_client_as_json(template)
+    exp_template = <<-EOS
+{
+  "Condition": {
+    "ArnEquals": {
+      "aws:SourceArn": "arn:aws:sns:REGION:123456789012:TOPIC-ID"
+    }
+  }
+}
+  EOS
+    assert_equal exp_template.chomp, act_template
+
+    #  {"StringLikeIfExists": {"ec2:InstanceType": [
+    #  "t1.*",
+    #  "t2.*",
+    #  "m3.*"
+    # ]}}
+    template = <<-EOS
+conds = [
+  { '=~': { exists: true, 'ec2:InstanceType': [ 't1.*', 't2.*', 'm3.*' ] } }
+]
+Condition _iam_policy_conditions(conds)
+    EOS
+    act_template = run_client_as_json(template)
+    exp_template = <<-EOS
+{
+  "Condition": {
+    "StringLikeIfExists": {
+      "ec2:InstanceType": [
+        "t1.*",
+        "t2.*",
+        "m3.*"
+      ]
+    }
+  }
+}
+  EOS
+    assert_equal exp_template.chomp, act_template
+
+    # {"Null":{"aws:TokenIssueTime":"true"}}
+    template = <<-EOS
+conds = [
+  { '=': { type: 'nil', 'aws:TokenIssueTime': 'true' } }
+]
+Condition _iam_policy_conditions(conds)
+    EOS
+    act_template = run_client_as_json(template)
+    exp_template = <<-EOS
+{
+  "Condition": {
+    "Null": {
+      "aws:TokenIssueTime": "true"
+    }
+  }
+}
+  EOS
+    assert_equal exp_template.chomp, act_template
+
+    # "StringEquals": {
+    #   "kms:EncryptionContext:aws:kinesis:arn":
+    #     "arn:aws:kinesis:%REGION_NAME%:12345:stream/%FIREHOSE_STREAM_NAME%"
+    # }
+    template = <<-EOS
+iam = _iam_arn('kinesis', [ { name: '%FIREHOSE_STREAM_NAME%' } ])
+conds = [
+  { '=': { 'kms:EncryptionContext:aws:kinesis:arn': iam } },
+]
+Condition _iam_policy_conditions(conds)
+    EOS
+    act_template = run_client_as_json(template)
+    exp_template = <<-EOS
+{
+  "Condition": {
+    "StringEquals": {
+      "kms:EncryptionContext:aws:kinesis:arn": {
+        "Fn::Sub": "arn:aws:kinesis:${AWS::Region}:${AWS::AccountId}:stream/%FIREHOSE_STREAM_NAME%"
+      }
+    }
+  }
 }
   EOS
     assert_equal exp_template.chomp, act_template

data/test/lambda_test.rb

@@ -26,7 +26,7 @@ Test _lambda_function_code(code: { zip_file: "test/data/lambda_function.py" })
   "Test": {
     "ZipFile": {
       "Fn::Join": [
-        "\\\\n",
+        "\\n",
         [
           "import boto3",
           "",