miam 0.1.0.beta → 0.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 78a6357ad96eb46c37e14554170823849a1b7299
-  data.tar.gz: 5e8e8b62d90cfa1d313874b5d842a505bb07bcfe
+  metadata.gz: 1c277e2932203a2740972ef45fb3588f25e08ced
+  data.tar.gz: 560435cc28118cc841397919249697a68a2e6851
 SHA512:
-  metadata.gz: 2bbe33cd3fc4274a239bfde9bff8eee340af294178b873f9b3f1c533a5efd02f0a41a960ee8d752f54c252eadba21a3f2a1484f939a94e16c96690e173e8ee3f
-  data.tar.gz: aa09af7d99890cd20908d5f6991846978bc40fcdf007e2cc7b152e72f81f13e49b00b9120646e34524ec95e66bc863a12b5586c49d54518146e4593fa8d01382
+  metadata.gz: f631ea1267d5c62723f85129e26508dc712b5189ea53e47ada4aacbcbc4b75f22bf56971364dc7490734343d2e62d885a6bbf68636d622550495a35bda2585b5
+  data.tar.gz: fa71e40019ca1342ec1472c07c1ae376b4233e1bda0129ed3715e9c151c751b43d1339e08f11018752ab080ed6cec1debcc79bc9a7104891f13f6eb99c4b3490

data/.rspec

@@ -0,0 +1,4 @@
+--require rspec/instafail
+--format RSpec::Instafail
+--colour
+--require spec_helper

data/.travis.yml

@@ -0,0 +1,11 @@
+language: ruby
+rvm:
+- 2.0.0
+script:
+- bundle install
+- bundle exec rake
+env:
+  global:
+  - secure: "Ec8bwSfp06anSzLJpGhkKjPz9EocMwl7H8t2LKoI3bKV/cz9JU0GhhUdUUmg3mCFH9+8/YGLzcbFKcxZIqnDK7ukdgTGsnGDevnctis0QwM7/nKHdkaK8JWhCx41TUXOqoiCKkNEnm1EbDtrILt4rJwb0BGXGnPjv6nLAyvdE2Y="
+  - secure: "Ky5Dpxc7SIqbQ4Y10m/jik/rVdeGMeh1439m3KB+tiV/Bz1hhWv4+If150ajLjbmWCZBPMLhxrTL0EePoyqYXpOGHvINvYM+/XCPcpP4iYkaTzr1MVIOMpa8A8aAOOgQWoGOwfyWoxfrYzv/TRvtMietnm+dZwVcbbkQ4ut7oa4="
+  - AWS_REGION=ap-northeast-1

data/README.md

@@ -4,6 +4,10 @@ Miam is a tool to manage IAM.
 
 It defines the state of IAM using DSL, and updates IAM according to DSL.
 
+[![Gem Version](https://badge.fury.io/rb/miam.svg)](http://badge.fury.io/rb/miam)
+[![Build Status](https://travis-ci.org/winebarrel/miam.svg?branch=master)](https://travis-ci.org/winebarrel/miam)
+[![Coverage Status](https://coveralls.io/repos/winebarrel/miam/badge.png?branch=master)](https://coveralls.io/r/winebarrel/miam?branch=master)
+
 ## Installation
 
 Add this line to your application's Gemfile:
@@ -18,7 +22,7 @@ And then execute:
 
 Or install it yourself as:
 
-    $ gem install miam --pre
+    $ gem install miam
 
 ## Usage
 
@@ -58,7 +62,7 @@ Usage: miam [options]
 ```ruby
 require 'other/iamfile'
 
-user "bob", path: "/developer/" do
+user "bob", :path => "/developer/" do
   login_profile password_reset_required: true
 
   groups(
@@ -76,7 +80,7 @@ user "bob", path: "/developer/" do
   end
 end
 
-user "mary", path: "/staff/" do
+user "mary", :path => "/staff/" do
   # login_profile password_reset_required: true
 
   groups(
@@ -104,9 +108,23 @@ user "mary", path: "/staff/" do
   end
 end
 
-group "Admin", path: "/admin/" do
+group "Admin", :path => "/admin/" do
   policy "Admin" do
     {"Statement"=>[{"Effect"=>"Allow", "Action"=>"*", "Resource"=>"*"}]}
   end
 end
 ```
+
+## Rename
+
+```ruby
+require 'other/iamfile'
+
+user "bob2", :path => "/developer/", :renamed_from => "bob" do
+  # ...
+end
+
+group "Admin2", :path => "/admin/". :renamed_from => "Admin" do
+  # ...
+end
+```

data/Rakefile

@@ -1,2 +1,5 @@
 require 'bundler/gem_tasks'
+require 'rspec/core/rake_task'
 
+RSpec::Core::RakeTask.new('spec')
+task :default => :spec

data/lib/miam/client.rb

@@ -53,6 +53,7 @@ class Miam::Client
       actual_attrs = actual.delete(user_name)
 
       if actual_attrs
+        updated = walk_path(:user, user_name, expected_attrs[:path], actual_attrs[:path]) || updated
         updated = walk_user(user_name, expected_attrs, actual_attrs) || updated
       else
         actual_attrs = @driver.create_user(user_name, expected_attrs)
@@ -83,7 +84,7 @@ class Miam::Client
   def walk_user(user_name, expected_attrs, actual_attrs)
     updated = walk_login_profile(user_name, expected_attrs[:login_profile], actual_attrs[:login_profile])
     updated = walk_user_groups(user_name, expected_attrs[:groups], actual_attrs[:groups]) || updated
-    walk_policies(:user, user_name, expected_attrs[:policies], actual_attrs[:policies])
+    walk_policies(:user, user_name, expected_attrs[:policies], actual_attrs[:policies]) || updated
   end
 
   def walk_login_profile(user_name, expected_login_profile, actual_login_profile)

data/lib/miam/version.rb

@@ -1,3 +1,3 @@
 module Miam
-  VERSION = '0.1.0.beta'
+  VERSION = '0.1.0'
 end

data/miam.gemspec

@@ -25,4 +25,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'term-ansicolor'
   spec.add_development_dependency 'bundler', '~> 1.7'
   spec.add_development_dependency 'rake', '~> 10.0'
+  spec.add_development_dependency 'rspec', '>= 3.0.0'
+  spec.add_development_dependency 'rspec-instafail'
+  spec.add_development_dependency 'coveralls'
 end

data/spec/miam/create_spec.rb

@@ -0,0 +1,114 @@
+describe 'create' do
+  context 'when empty' do
+    subject { client }
+
+    it do
+      updated = apply(subject) { '' }
+      expect(updated).to be_falsey
+      expect(export).to eq({:users=>{}, :groups=>{}})
+    end
+  end
+
+  context 'when create user and group' do
+    let(:dsl) do
+      <<-RUBY
+        user "bob", :path=>"/devloper/" do
+          login_profile :password_reset_required=>true
+
+          groups(
+            "Admin",
+            "SES"
+          )
+
+          policy "S3" do
+            {"Statement"=>
+              [{"Action"=>
+                 ["s3:Get*",
+                  "s3:List*"],
+                "Effect"=>"Allow",
+                "Resource"=>"*"}]}
+          end
+        end
+
+        user "mary", :path=>"/staff/" do
+          policy "S3" do
+            {"Statement"=>
+              [{"Action"=>
+                 ["s3:Get*",
+                  "s3:List*"],
+                "Effect"=>"Allow",
+                "Resource"=>"*"}]}
+          end
+        end
+
+        group "Admin", :path=>"/admin/" do
+          policy "Admin" do
+            {"Statement"=>[{"Effect"=>"Allow", "Action"=>"*", "Resource"=>"*"}]}
+          end
+        end
+
+        group "SES", :path=>"/ses/" do
+          policy "ses-policy" do
+            {"Statement"=>
+              [{"Effect"=>"Allow", "Action"=>"ses:SendRawEmail", "Resource"=>"*"}]}
+          end
+        end
+      RUBY
+    end
+
+    context 'when apply' do
+      subject { client }
+
+      it do
+        updated = apply(subject) { dsl }
+        expect(updated).to be_truthy
+        expect(export).to eq(
+          {:users=>
+            {"bob"=>
+              {:path=>"/devloper/",
+               :groups=>["Admin", "SES"],
+               :policies=>
+                {"S3"=>
+                  {"Statement"=>
+                    [{"Action"=>["s3:Get*", "s3:List*"],
+                      "Effect"=>"Allow",
+                      "Resource"=>"*"}]}},
+               :login_profile=>{:password_reset_required=>true}},
+             "mary"=>
+              {:path=>"/staff/",
+               :groups=>[],
+               :policies=>
+                {"S3"=>
+                  {"Statement"=>
+                    [{"Action"=>["s3:Get*", "s3:List*"],
+                      "Effect"=>"Allow",
+                      "Resource"=>"*"}]}}}},
+           :groups=>
+            {"Admin"=>
+              {:path=>"/admin/",
+               :policies=>
+                {"Admin"=>
+                  {"Statement"=>[{"Effect"=>"Allow", "Action"=>"*", "Resource"=>"*"}]}}},
+             "SES"=>
+              {:path=>"/ses/",
+               :policies=>
+                {"ses-policy"=>
+                  {"Statement"=>
+                    [{"Effect"=>"Allow",
+                      "Action"=>"ses:SendRawEmail",
+                      "Resource"=>"*"}]}}}}}
+        )
+      end
+    end
+
+    context 'when dry-run' do
+      subject { client(dry_run: true) }
+
+      it do
+        updated = apply(subject) { dsl }
+        expect(updated).to be_falsey
+        expect(export).to eq({:users=>{}, :groups=>{}})
+      end
+    end
+  end
+end

data/spec/miam/delete_spec.rb

@@ -0,0 +1,222 @@
+describe 'delete' do
+  let(:dsl) do
+    <<-RUBY
+      user "bob", :path=>"/devloper/" do
+        login_profile :password_reset_required=>true
+
+        groups(
+          "Admin",
+          "SES"
+        )
+
+        policy "S3" do
+          {"Statement"=>
+            [{"Action"=>
+               ["s3:Get*",
+                "s3:List*"],
+              "Effect"=>"Allow",
+              "Resource"=>"*"}]}
+        end
+      end
+
+      user "mary", :path=>"/staff/" do
+        policy "S3" do
+          {"Statement"=>
+            [{"Action"=>
+               ["s3:Get*",
+                "s3:List*"],
+              "Effect"=>"Allow",
+              "Resource"=>"*"}]}
+        end
+      end
+
+      group "Admin", :path=>"/admin/" do
+        policy "Admin" do
+          {"Statement"=>[{"Effect"=>"Allow", "Action"=>"*", "Resource"=>"*"}]}
+        end
+      end
+
+      group "SES", :path=>"/ses/" do
+        policy "ses-policy" do
+          {"Statement"=>
+            [{"Effect"=>"Allow", "Action"=>"ses:SendRawEmail", "Resource"=>"*"}]}
+        end
+      end
+    RUBY
+  end
+
+  let(:expected) do
+    {:users=>
+      {"bob"=>
+        {:path=>"/devloper/",
+         :groups=>["Admin", "SES"],
+         :policies=>
+          {"S3"=>
+            {"Statement"=>
+              [{"Action"=>["s3:Get*", "s3:List*"],
+                "Effect"=>"Allow",
+                "Resource"=>"*"}]}},
+         :login_profile=>{:password_reset_required=>true}},
+       "mary"=>
+        {:path=>"/staff/",
+         :groups=>[],
+         :policies=>
+          {"S3"=>
+            {"Statement"=>
+              [{"Action"=>["s3:Get*", "s3:List*"],
+                "Effect"=>"Allow",
+                "Resource"=>"*"}]}}}},
+     :groups=>
+      {"Admin"=>
+        {:path=>"/admin/",
+         :policies=>
+          {"Admin"=>
+            {"Statement"=>[{"Effect"=>"Allow", "Action"=>"*", "Resource"=>"*"}]}}},
+       "SES"=>
+        {:path=>"/ses/",
+         :policies=>
+          {"ses-policy"=>
+            {"Statement"=>
+              [{"Effect"=>"Allow",
+                "Action"=>"ses:SendRawEmail",
+                "Resource"=>"*"}]}}}}}
+  end
+
+  before(:each) do
+    apply { dsl }
+  end
+
+  context 'when delete group' do
+    let(:delete_group_dsl) do
+      <<-RUBY
+        user "bob", :path=>"/devloper/" do
+          login_profile :password_reset_required=>true
+
+          groups(
+            "Admin"
+          )
+
+          policy "S3" do
+            {"Statement"=>
+              [{"Action"=>
+                 ["s3:Get*",
+                  "s3:List*"],
+                "Effect"=>"Allow",
+                "Resource"=>"*"}]}
+          end
+        end
+
+        user "mary", :path=>"/staff/" do
+          policy "S3" do
+            {"Statement"=>
+              [{"Action"=>
+                 ["s3:Get*",
+                  "s3:List*"],
+                "Effect"=>"Allow",
+                "Resource"=>"*"}]}
+          end
+        end
+
+        group "Admin", :path=>"/admin/" do
+          policy "Admin" do
+            {"Statement"=>[{"Effect"=>"Allow", "Action"=>"*", "Resource"=>"*"}]}
+          end
+        end
+      RUBY
+    end
+
+    subject { client }
+
+    it do
+      updated = apply(subject) { delete_group_dsl }
+      expect(updated).to be_truthy
+      expected[:users]["bob"][:groups] = ["Admin"]
+      expected[:groups].delete("SES")
+      expect(export).to eq expected
+    end
+  end
+
+  context 'when delete user' do
+    let(:delete_user_dsl) do
+      <<-RUBY
+        user "mary", :path=>"/staff/" do
+          policy "S3" do
+            {"Statement"=>
+              [{"Action"=>
+                 ["s3:Get*",
+                  "s3:List*"],
+                "Effect"=>"Allow",
+                "Resource"=>"*"}]}
+          end
+        end
+
+        group "Admin", :path=>"/admin/" do
+          policy "Admin" do
+            {"Statement"=>[{"Effect"=>"Allow", "Action"=>"*", "Resource"=>"*"}]}
+          end
+        end
+
+        group "SES", :path=>"/ses/" do
+          policy "ses-policy" do
+            {"Statement"=>
+              [{"Effect"=>"Allow", "Action"=>"ses:SendRawEmail", "Resource"=>"*"}]}
+          end
+        end
+      RUBY
+    end
+
+    subject { client }
+
+    it do
+      updated = apply(subject) { delete_user_dsl }
+      expect(updated).to be_truthy
+      expected[:users].delete("bob")
+      expect(export).to eq expected
+    end
+  end
+
+  context 'when delete user_and_group' do
+    let(:delete_user_and_group_dsl) do
+      <<-RUBY
+        user "mary", :path=>"/staff/" do
+          policy "S3" do
+            {"Statement"=>
+              [{"Action"=>
+                 ["s3:Get*",
+                  "s3:List*"],
+                "Effect"=>"Allow",
+                "Resource"=>"*"}]}
+          end
+        end
+
+        group "Admin", :path=>"/admin/" do
+          policy "Admin" do
+            {"Statement"=>[{"Effect"=>"Allow", "Action"=>"*", "Resource"=>"*"}]}
+          end
+        end
+      RUBY
+    end
+
+    context 'when apply' do
+      subject { client }
+
+      it do
+        updated = apply(subject) { delete_user_and_group_dsl }
+        expect(updated).to be_truthy
+        expected[:users].delete("bob")
+        expected[:groups].delete("SES")
+        expect(export).to eq expected
+      end
+    end
+
+    context 'when dry-run' do
+      subject { client(dry_run: true) }
+
+      it do
+        updated = apply(subject) { delete_user_and_group_dsl }
+        expect(updated).to be_falsey
+        expect(export).to eq expected
+      end
+    end
+  end
+end

data/spec/miam/rename_spec.rb

@@ -0,0 +1,262 @@
+describe 'update' do
+  let(:dsl) do
+    <<-RUBY
+      user "bob", :path=>"/devloper/" do
+        login_profile :password_reset_required=>true
+
+        groups(
+          "Admin",
+          "SES"
+        )
+
+        policy "S3" do
+          {"Statement"=>
+            [{"Action"=>
+               ["s3:Get*",
+                "s3:List*"],
+              "Effect"=>"Allow",
+              "Resource"=>"*"}]}
+        end
+      end
+
+      user "mary", :path=>"/staff/" do
+        policy "S3" do
+          {"Statement"=>
+            [{"Action"=>
+               ["s3:Get*",
+                "s3:List*"],
+              "Effect"=>"Allow",
+              "Resource"=>"*"}]}
+        end
+      end
+
+      group "Admin", :path=>"/admin/" do
+        policy "Admin" do
+          {"Statement"=>[{"Effect"=>"Allow", "Action"=>"*", "Resource"=>"*"}]}
+        end
+      end
+
+      group "SES", :path=>"/ses/" do
+        policy "ses-policy" do
+          {"Statement"=>
+            [{"Effect"=>"Allow", "Action"=>"ses:SendRawEmail", "Resource"=>"*"}]}
+        end
+      end
+    RUBY
+  end
+
+  let(:expected) do
+    {:users=>
+      {"bob"=>
+        {:path=>"/devloper/",
+         :groups=>["Admin", "SES"],
+         :policies=>
+          {"S3"=>
+            {"Statement"=>
+              [{"Action"=>["s3:Get*", "s3:List*"],
+                "Effect"=>"Allow",
+                "Resource"=>"*"}]}},
+         :login_profile=>{:password_reset_required=>true}},
+       "mary"=>
+        {:path=>"/staff/",
+         :groups=>[],
+         :policies=>
+          {"S3"=>
+            {"Statement"=>
+              [{"Action"=>["s3:Get*", "s3:List*"],
+                "Effect"=>"Allow",
+                "Resource"=>"*"}]}}}},
+     :groups=>
+      {"Admin"=>
+        {:path=>"/admin/",
+         :policies=>
+          {"Admin"=>
+            {"Statement"=>[{"Effect"=>"Allow", "Action"=>"*", "Resource"=>"*"}]}}},
+       "SES"=>
+        {:path=>"/ses/",
+         :policies=>
+          {"ses-policy"=>
+            {"Statement"=>
+              [{"Effect"=>"Allow",
+                "Action"=>"ses:SendRawEmail",
+                "Resource"=>"*"}]}}}}}
+  end
+
+  before(:each) do
+    apply { dsl }
+  end
+
+  context 'when rename user' do
+    let(:rename_user_dsl) do
+      <<-RUBY
+        user "bob2", :path=>"/devloper/", :renamed_from=>"bob" do
+          login_profile :password_reset_required=>true
+
+          groups(
+            "Admin",
+            "SES"
+          )
+
+          policy "S3" do
+            {"Statement"=>
+              [{"Action"=>
+                 ["s3:Get*",
+                  "s3:List*"],
+                "Effect"=>"Allow",
+                "Resource"=>"*"}]}
+          end
+        end
+
+        user "mary", :path=>"/staff/" do
+          policy "S3" do
+            {"Statement"=>
+              [{"Action"=>
+                 ["s3:Get*",
+                  "s3:List*"],
+                "Effect"=>"Allow",
+                "Resource"=>"*"}]}
+          end
+        end
+
+        group "Admin", :path=>"/admin/" do
+          policy "Admin" do
+            {"Statement"=>[{"Effect"=>"Allow", "Action"=>"*", "Resource"=>"*"}]}
+          end
+        end
+
+        group "SES", :path=>"/ses/" do
+          policy "ses-policy" do
+            {"Statement"=>
+              [{"Effect"=>"Allow", "Action"=>"ses:SendRawEmail", "Resource"=>"*"}]}
+          end
+        end
+      RUBY
+    end
+
+    subject { client }
+
+    it do
+      updated = apply(subject) { rename_user_dsl }
+      expect(updated).to be_truthy
+      expected[:users]["bob2"] = expected[:users].delete("bob")
+      expect(export).to eq expected
+    end
+  end
+
+  context 'when rename group' do
+    let(:rename_group_dsl) do
+      <<-RUBY
+        user "bob", :path=>"/devloper/" do
+          login_profile :password_reset_required=>true
+
+          groups(
+            "Admin",
+            "SES2"
+          )
+
+          policy "S3" do
+            {"Statement"=>
+              [{"Action"=>
+                 ["s3:Get*",
+                  "s3:List*"],
+                "Effect"=>"Allow",
+                "Resource"=>"*"}]}
+          end
+        end
+
+        user "mary", :path=>"/staff/" do
+          policy "S3" do
+            {"Statement"=>
+              [{"Action"=>
+                 ["s3:Get*",
+                  "s3:List*"],
+                "Effect"=>"Allow",
+                "Resource"=>"*"}]}
+          end
+        end
+
+        group "Admin", :path=>"/admin/" do
+          policy "Admin" do
+            {"Statement"=>[{"Effect"=>"Allow", "Action"=>"*", "Resource"=>"*"}]}
+          end
+        end
+
+        group "SES2", :path=>"/ses/", :renamed_from=>"SES2" do
+          policy "ses-policy" do
+            {"Statement"=>
+              [{"Effect"=>"Allow", "Action"=>"ses:SendRawEmail", "Resource"=>"*"}]}
+          end
+        end
+      RUBY
+    end
+
+    subject { client }
+
+    it do
+      updated = apply(subject) { rename_group_dsl }
+      expect(updated).to be_truthy
+      expected[:users]["bob"][:groups] = ["Admin", "SES2"]
+      expected[:groups]["SES2"] = expected[:groups].delete("SES")
+      expect(export).to eq expected
+    end
+  end
+
+  context 'when rename without renamed_from' do
+    let(:rename_without_renamed_from_dsl) do
+      <<-RUBY
+        user "bob2", :path=>"/devloper/" do
+          login_profile :password_reset_required=>true
+
+          groups(
+            "Admin",
+            "SES2"
+          )
+
+          policy "S3" do
+            {"Statement"=>
+              [{"Action"=>
+                 ["s3:Get*",
+                  "s3:List*"],
+                "Effect"=>"Allow",
+                "Resource"=>"*"}]}
+          end
+        end
+
+        user "mary", :path=>"/staff/" do
+          policy "S3" do
+            {"Statement"=>
+              [{"Action"=>
+                 ["s3:Get*",
+                  "s3:List*"],
+                "Effect"=>"Allow",
+                "Resource"=>"*"}]}
+          end
+        end
+
+        group "Admin", :path=>"/admin/" do
+          policy "Admin" do
+            {"Statement"=>[{"Effect"=>"Allow", "Action"=>"*", "Resource"=>"*"}]}
+          end
+        end
+
+        group "SES2", :path=>"/ses/" do
+          policy "ses-policy" do
+            {"Statement"=>
+              [{"Effect"=>"Allow", "Action"=>"ses:SendRawEmail", "Resource"=>"*"}]}
+          end
+        end
+      RUBY
+    end
+
+    subject { client }
+
+    it do
+      updated = apply(subject) { rename_without_renamed_from_dsl }
+      expect(updated).to be_truthy
+      expected[:users]["bob"][:groups] = ["Admin", "SES2"]
+      expected[:users]["bob2"] = expected[:users].delete("bob")
+      expected[:groups]["SES2"] = expected[:groups].delete("SES")
+      expect(export).to eq expected
+    end
+  end
+end

data/spec/miam/update_spec.rb

@@ -0,0 +1,434 @@
+describe 'update' do
+  let(:dsl) do
+    <<-RUBY
+      user "bob", :path=>"/devloper/" do
+        login_profile :password_reset_required=>true
+
+        groups(
+          "Admin",
+          "SES"
+        )
+
+        policy "S3" do
+          {"Statement"=>
+            [{"Action"=>
+               ["s3:Get*",
+                "s3:List*"],
+              "Effect"=>"Allow",
+              "Resource"=>"*"}]}
+        end
+      end
+
+      user "mary", :path=>"/staff/" do
+        policy "S3" do
+          {"Statement"=>
+            [{"Action"=>
+               ["s3:Get*",
+                "s3:List*"],
+              "Effect"=>"Allow",
+              "Resource"=>"*"}]}
+        end
+      end
+
+      group "Admin", :path=>"/admin/" do
+        policy "Admin" do
+          {"Statement"=>[{"Effect"=>"Allow", "Action"=>"*", "Resource"=>"*"}]}
+        end
+      end
+
+      group "SES", :path=>"/ses/" do
+        policy "ses-policy" do
+          {"Statement"=>
+            [{"Effect"=>"Allow", "Action"=>"ses:SendRawEmail", "Resource"=>"*"}]}
+        end
+      end
+    RUBY
+  end
+
+  let(:expected) do
+    {:users=>
+      {"bob"=>
+        {:path=>"/devloper/",
+         :groups=>["Admin", "SES"],
+         :policies=>
+          {"S3"=>
+            {"Statement"=>
+              [{"Action"=>["s3:Get*", "s3:List*"],
+                "Effect"=>"Allow",
+                "Resource"=>"*"}]}},
+         :login_profile=>{:password_reset_required=>true}},
+       "mary"=>
+        {:path=>"/staff/",
+         :groups=>[],
+         :policies=>
+          {"S3"=>
+            {"Statement"=>
+              [{"Action"=>["s3:Get*", "s3:List*"],
+                "Effect"=>"Allow",
+                "Resource"=>"*"}]}}}},
+     :groups=>
+      {"Admin"=>
+        {:path=>"/admin/",
+         :policies=>
+          {"Admin"=>
+            {"Statement"=>[{"Effect"=>"Allow", "Action"=>"*", "Resource"=>"*"}]}}},
+       "SES"=>
+        {:path=>"/ses/",
+         :policies=>
+          {"ses-policy"=>
+            {"Statement"=>
+              [{"Effect"=>"Allow",
+                "Action"=>"ses:SendRawEmail",
+                "Resource"=>"*"}]}}}}}
+  end
+
+  before(:each) do
+    apply { dsl }
+  end
+
+  context 'when no change' do
+    subject { client }
+
+    it do
+      updated = apply(subject) { dsl }
+      expect(updated).to be_falsey
+      expect(export).to eq expected
+    end
+  end
+
+  context 'when update policy' do
+    let(:update_policy_dsl) do
+      <<-RUBY
+        user "bob", :path=>"/devloper/" do
+          login_profile :password_reset_required=>true
+
+          groups(
+            "Admin",
+            "SES"
+          )
+
+          policy "S3" do
+            {"Statement"=>
+              [{"Action"=>
+                 ["s3:Get*",
+                  "s3:List*"],
+                "Effect"=>"Allow",
+                "Resource"=>"*"}]}
+          end
+        end
+
+        user "mary", :path=>"/staff/" do
+          policy "S3" do
+            {"Statement"=>
+              [{"Action"=>
+                 ["s3:Get*",
+                  "s3:Put*",
+                  "s3:List*"],
+                "Effect"=>"Allow",
+                "Resource"=>"*"}]}
+          end
+        end
+
+        group "Admin", :path=>"/admin/" do
+          policy "Admin" do
+            {"Statement"=>[{"Effect"=>"Allow", "Action"=>"*", "Resource"=>"*"}]}
+          end
+        end
+
+        group "SES", :path=>"/ses/" do
+          policy "ses-policy" do
+            {"Statement"=>
+              [{"Effect"=>"Allow", "Action"=>"*", "Resource"=>"*"}]}
+          end
+        end
+      RUBY
+    end
+
+    subject { client }
+
+    it do
+      updated = apply(subject) { update_policy_dsl }
+      expect(updated).to be_truthy
+      expected[:users]["mary"][:policies]["S3"]["Statement"][0]["Action"] = ["s3:Get*", "s3:Put*", "s3:List*"]
+      expected[:groups]["SES"][:policies]["ses-policy"]["Statement"][0]["Action"] = "*"
+      expect(export).to eq expected
+    end
+  end
+
+  context 'when update path' do
+    let(:update_path_dsl) do
+      <<-RUBY
+        user "bob", :path=>"/devloper/" do
+          login_profile :password_reset_required=>true
+
+          groups(
+            "Admin",
+            "SES"
+          )
+
+          policy "S3" do
+            {"Statement"=>
+              [{"Action"=>
+                 ["s3:Get*",
+                  "s3:List*"],
+                "Effect"=>"Allow",
+                "Resource"=>"*"}]}
+          end
+        end
+
+        user "mary", :path=>"/xstaff/" do
+          policy "S3" do
+            {"Statement"=>
+              [{"Action"=>
+                 ["s3:Get*",
+                  "s3:List*"],
+                "Effect"=>"Allow",
+                "Resource"=>"*"}]}
+          end
+        end
+
+        group "Admin", :path=>"/admin/" do
+          policy "Admin" do
+            {"Statement"=>[{"Effect"=>"Allow", "Action"=>"*", "Resource"=>"*"}]}
+          end
+        end
+
+        group "SES", :path=>"/ses/ses/" do
+          policy "ses-policy" do
+            {"Statement"=>
+              [{"Effect"=>"Allow", "Action"=>"ses:SendRawEmail", "Resource"=>"*"}]}
+          end
+        end
+      RUBY
+    end
+
+    subject { client }
+
+    it do
+      updated = apply(subject) { update_path_dsl }
+      expect(updated).to be_truthy
+      expected[:users]["mary"][:path] = "/xstaff/"
+      expected[:groups]["SES"][:path] = "/ses/ses/"
+      expect(export).to eq expected
+    end
+  end
+
+  context 'when update groups' do
+    let(:update_groups_dsl) do
+      <<-RUBY
+        user "bob", :path=>"/devloper/" do
+          login_profile :password_reset_required=>true
+
+          groups(
+            "Admin"
+          )
+
+          policy "S3" do
+            {"Statement"=>
+              [{"Action"=>
+                 ["s3:Get*",
+                  "s3:List*"],
+                "Effect"=>"Allow",
+                "Resource"=>"*"}]}
+          end
+        end
+
+        user "mary", :path=>"/staff/" do
+          groups(
+            "Admin",
+            "SES"
+          )
+
+          policy "S3" do
+            {"Statement"=>
+              [{"Action"=>
+                 ["s3:Get*",
+                  "s3:List*"],
+                "Effect"=>"Allow",
+                "Resource"=>"*"}]}
+          end
+        end
+
+        group "Admin", :path=>"/admin/" do
+          policy "Admin" do
+            {"Statement"=>[{"Effect"=>"Allow", "Action"=>"*", "Resource"=>"*"}]}
+          end
+        end
+
+        group "SES", :path=>"/ses/" do
+          policy "ses-policy" do
+            {"Statement"=>
+              [{"Effect"=>"Allow", "Action"=>"ses:SendRawEmail", "Resource"=>"*"}]}
+          end
+        end
+      RUBY
+    end
+
+    subject { client }
+
+    it do
+      updated = apply(subject) { update_groups_dsl }
+      expect(updated).to be_truthy
+      expected[:users]["bob"][:groups] = ["Admin"]
+      expected[:users]["mary"][:groups] = ["Admin", "SES"]
+      expect(export).to eq expected
+    end
+  end
+
+  context 'when update login_profile' do
+    let(:update_login_profile_dsl) do
+      <<-RUBY
+        user "bob", :path=>"/devloper/" do
+          login_profile :password_reset_required=>false
+
+          groups(
+            "Admin",
+            "SES"
+          )
+
+          policy "S3" do
+            {"Statement"=>
+              [{"Action"=>
+                 ["s3:Get*",
+                  "s3:List*"],
+                "Effect"=>"Allow",
+                "Resource"=>"*"}]}
+          end
+        end
+
+        user "mary", :path=>"/staff/" do
+          policy "S3" do
+            {"Statement"=>
+              [{"Action"=>
+                 ["s3:Get*",
+                  "s3:List*"],
+                "Effect"=>"Allow",
+                "Resource"=>"*"}]}
+          end
+        end
+
+        group "Admin", :path=>"/admin/" do
+          policy "Admin" do
+            {"Statement"=>[{"Effect"=>"Allow", "Action"=>"*", "Resource"=>"*"}]}
+          end
+        end
+
+        group "SES", :path=>"/ses/" do
+          policy "ses-policy" do
+            {"Statement"=>
+              [{"Effect"=>"Allow", "Action"=>"ses:SendRawEmail", "Resource"=>"*"}]}
+          end
+        end
+      RUBY
+    end
+
+    subject { client }
+
+    it do
+      updated = apply(subject) { update_login_profile_dsl }
+      expect(updated).to be_truthy
+      expected[:users]["bob"][:login_profile][:password_reset_required] = false
+      expect(export).to eq expected
+    end
+  end
+
+  context 'when delete login_profile' do
+    let(:delete_login_profile_dsl) do
+      <<-RUBY
+        user "bob", :path=>"/devloper/" do
+          groups(
+            "Admin",
+            "SES"
+          )
+
+          policy "S3" do
+            {"Statement"=>
+              [{"Action"=>
+                 ["s3:Get*",
+                  "s3:List*"],
+                "Effect"=>"Allow",
+                "Resource"=>"*"}]}
+          end
+        end
+
+        user "mary", :path=>"/staff/" do
+          policy "S3" do
+            {"Statement"=>
+              [{"Action"=>
+                 ["s3:Get*",
+                  "s3:List*"],
+                "Effect"=>"Allow",
+                "Resource"=>"*"}]}
+          end
+        end
+
+        group "Admin", :path=>"/admin/" do
+          policy "Admin" do
+            {"Statement"=>[{"Effect"=>"Allow", "Action"=>"*", "Resource"=>"*"}]}
+          end
+        end
+
+        group "SES", :path=>"/ses/" do
+          policy "ses-policy" do
+            {"Statement"=>
+              [{"Effect"=>"Allow", "Action"=>"ses:SendRawEmail", "Resource"=>"*"}]}
+          end
+        end
+      RUBY
+    end
+
+    subject { client }
+
+    it do
+      updated = apply(subject) { delete_login_profile_dsl }
+      expect(updated).to be_truthy
+      expected[:users]["bob"].delete(:login_profile)
+      expect(export).to eq expected
+    end
+  end
+
+  context 'when delete policy' do
+    let(:delete_policy_dsl) do
+      <<-RUBY
+        user "bob", :path=>"/devloper/" do
+          login_profile :password_reset_required=>true
+
+          groups(
+            "Admin",
+            "SES"
+          )
+        end
+
+        user "mary", :path=>"/staff/" do
+          policy "S3" do
+            {"Statement"=>
+              [{"Action"=>
+                 ["s3:Get*",
+                  "s3:List*"],
+                "Effect"=>"Allow",
+                "Resource"=>"*"}]}
+          end
+        end
+
+        group "Admin", :path=>"/admin/" do
+          policy "Admin" do
+            {"Statement"=>[{"Effect"=>"Allow", "Action"=>"*", "Resource"=>"*"}]}
+          end
+        end
+
+        group "SES", :path=>"/ses/" do
+        end
+      RUBY
+    end
+
+    subject { client }
+
+    it do
+      updated = apply(subject) { delete_policy_dsl }
+      expect(updated).to be_truthy
+      expected[:users]["bob"][:policies].delete("S3")
+      expected[:groups]["SES"][:policies].delete("ses-policy")
+      expect(export).to eq expected
+    end
+  end
+end

data/spec/spec_helper.rb

@@ -0,0 +1,84 @@
+if ENV['TRAVIS']
+  require 'simplecov'
+  require 'coveralls'
+
+  SimpleCov.formatter = Coveralls::SimpleCov::Formatter
+  SimpleCov.start do
+    add_filter "spec/"
+  end
+end
+
+require 'tempfile'
+require 'miam'
+
+Aws.config.update(
+  access_key_id: ENV['MIAM_TEST_ACCESS_KEY_ID'],
+  secret_access_key: ENV['MIAM_TEST_SECRET_ACCESS_KEY']
+)
+
+RSpec.configure do |config|
+  config.before(:each) do
+    apply { '' }
+  end
+
+  config.after(:all) do
+    apply { '' }
+  end
+end
+
+def client(user_options = {})
+  options = {
+    password_manager: Miam::PasswordManager.new('/dev/null'),
+    logger: Logger.new('/dev/null'),
+    no_progress: true
+  }
+
+  if_debug do
+    logger = Miam::Logger.instance
+    logger.set_debug(true)
+
+    options.update(
+      debug: true,
+      logger: logger,
+      aws_config: {
+        http_wire_trace: true,
+        logger: logger
+      }
+    )
+  end
+
+  options = options.merge(user_options)
+  Miam::Client.new(options)
+end
+
+def tempfile(content, options = {})
+  basename = "#{File.basename __FILE__}.#{$$}"
+  basename = [basename, options[:ext]] if options[:ext]
+
+  Tempfile.open(basename) do |f|
+    f.puts(content)
+    f.flush
+    f.rewind
+    yield(f)
+  end
+end
+
+def apply(cli = client)
+  tempfile(yield) do |f|
+    begin
+      cli.apply(f.path)
+    rescue Aws::IAM::Errors::EntityTemporarilyUnmodifiable
+      sleep 3
+      retry
+    end
+  end
+end
+
+def export(options = {})
+  cli = options.delete(:client) || Aws::IAM::Client.new
+  Miam::Exporter.export(cli, options)[0]
+end
+
+def if_debug
+  yield if ENV['DEBUG'] == '1'
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: miam
 version: !ruby/object:Gem::Version
-  version: 0.1.0.beta
+  version: 0.1.0
 platform: ruby
 authors:
 - Genki Sugawara
@@ -80,6 +80,48 @@ dependencies:
     - - ~>
       - !ruby/object:Gem::Version
         version: '10.0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: 3.0.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: 3.0.0
+- !ruby/object:Gem::Dependency
+  name: rspec-instafail
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: coveralls
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 description: Miam is a tool to manage IAM. It defines the state of IAM using DSL,
   and updates IAM according to DSL.
 email:
@@ -90,6 +132,8 @@ extensions: []
 extra_rdoc_files: []
 files:
 - .gitignore
+- .rspec
+- .travis.yml
 - Gemfile
 - LICENSE.txt
 - README.md
@@ -110,6 +154,11 @@ files:
 - lib/miam/utils.rb
 - lib/miam/version.rb
 - miam.gemspec
+- spec/miam/create_spec.rb
+- spec/miam/delete_spec.rb
+- spec/miam/rename_spec.rb
+- spec/miam/update_spec.rb
+- spec/spec_helper.rb
 homepage: https://github.com/winebarrel/miam
 licenses:
 - MIT
@@ -125,13 +174,18 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>'
+  - - '>='
     - !ruby/object:Gem::Version
-      version: 1.3.1
+      version: '0'
 requirements: []
 rubyforge_project: 
 rubygems_version: 2.4.1
 signing_key: 
 specification_version: 4
 summary: Miam is a tool to manage IAM.
-test_files: []
+test_files:
+- spec/miam/create_spec.rb
+- spec/miam/delete_spec.rb
+- spec/miam/rename_spec.rb
+- spec/miam/update_spec.rb
+- spec/spec_helper.rb