toil 6.1.0a1__py3-none-any.whl → 8.0.0__py3-none-any.whl

toil/test/lib/aws/test_iam.py

@@ -13,9 +13,10 @@
 # limitations under the License.
 import json
 import logging
+from uuid import uuid4
 
 import boto3
-from moto import mock_iam
+from moto import mock_aws
 
 from toil.lib.aws import iam
 from toil.test import ToilTest
@@ -28,25 +29,47 @@ class IAMTest(ToilTest):
     """Check that given permissions and associated functions perform correctly"""
 
     def test_permissions_iam(self):
-        granted_perms = {'*': {'Action': ['ec2:*', 'iam:*', 's3:*', 'sdb:*'], 'NotAction': []}}
-        assert iam.policy_permissions_allow(granted_perms, iam.CLUSTER_LAUNCHING_PERMISSIONS) is True
-        granted_perms = {'*': {'Action': [], 'NotAction': ['s3:*']}}
-        assert iam.policy_permissions_allow(granted_perms, iam.CLUSTER_LAUNCHING_PERMISSIONS) is True
+        granted_perms = {
+            "*": {"Action": ["ec2:*", "iam:*", "s3:*", "sdb:*"], "NotAction": []}
+        }
+        assert (
+            iam.policy_permissions_allow(
+                granted_perms, iam.CLUSTER_LAUNCHING_PERMISSIONS
+            )
+            is True
+        )
+        granted_perms = {"*": {"Action": [], "NotAction": ["s3:*"]}}
+        assert (
+            iam.policy_permissions_allow(
+                granted_perms, iam.CLUSTER_LAUNCHING_PERMISSIONS
+            )
+            is True
+        )
 
     def test_negative_permissions_iam(self):
-        granted_perms = {'*': {'Action': ['ec2:*', 's3:*', 'sdb:*'], 'NotAction': []}}
-        assert iam.policy_permissions_allow(granted_perms, iam.CLUSTER_LAUNCHING_PERMISSIONS) is False
-        granted_perms = {'*': {'Action': [], 'NotAction': ['iam:*', 'ec2:*']}}
-        assert iam.policy_permissions_allow(granted_perms, iam.CLUSTER_LAUNCHING_PERMISSIONS) is False
+        granted_perms = {"*": {"Action": ["ec2:*", "s3:*", "sdb:*"], "NotAction": []}}
+        assert (
+            iam.policy_permissions_allow(
+                granted_perms, iam.CLUSTER_LAUNCHING_PERMISSIONS
+            )
+            is False
+        )
+        granted_perms = {"*": {"Action": [], "NotAction": ["iam:*", "ec2:*"]}}
+        assert (
+            iam.policy_permissions_allow(
+                granted_perms, iam.CLUSTER_LAUNCHING_PERMISSIONS
+            )
+            is False
+        )
 
     def test_wildcard_handling(self):
-        assert iam.permission_matches_any("iam:CreateRole", ['iam:Create**']) is True
-        assert iam.permission_matches_any("iam:GetUser", ['iam:???????']) is True
-        assert iam.permission_matches_any("iam:ListRoleTags", ['iam:*?*Tags']) is True
+        assert iam.permission_matches_any("iam:CreateRole", ["iam:Create**"]) is True
+        assert iam.permission_matches_any("iam:GetUser", ["iam:???????"]) is True
+        assert iam.permission_matches_any("iam:ListRoleTags", ["iam:*?*Tags"]) is True
         assert iam.permission_matches_any("iam:*", ["*"]) is True
-        assert iam.permission_matches_any("ec2:*", ['iam:*']) is False
+        assert iam.permission_matches_any("ec2:*", ["iam:*"]) is False
 
-    @mock_iam
+    @mock_aws
     def test_get_policy_permissions(self):
         mock_iam = boto3.client("iam")
 
@@ -55,68 +78,77 @@ class IAMTest(ToilTest):
         mock_iam.create_user(UserName=user_name)
 
         group_name = "default_group"
-        mock_iam.create_group(
-            GroupName=group_name
-        )
+        mock_iam.create_group(GroupName=group_name)
 
-        mock_iam.add_user_to_group(
-            GroupName=group_name,
-            UserName=user_name
-        )
+        mock_iam.add_user_to_group(GroupName=group_name, UserName=user_name)
 
         policy_response = mock_iam.create_policy(
             PolicyName="test_iam_createrole",
-            PolicyDocument=json.dumps({
-                "Version": "2012-10-17",  # represents version language
-                "Statement": [
-                    {"Effect": "Allow", "Action": "iam:CreateRole", "Resource": "*"}
-                ]
-            })
+            PolicyDocument=json.dumps(
+                {
+                    "Version": "2012-10-17",  # represents version language
+                    "Statement": [
+                        {"Effect": "Allow", "Action": "iam:CreateRole", "Resource": "*"}
+                    ],
+                }
+            ),
         )
         # attached user policy
         mock_iam.attach_user_policy(
-            UserName=user_name,
-            PolicyArn=policy_response["Policy"]["Arn"]
+            UserName=user_name, PolicyArn=policy_response["Policy"]["Arn"]
         )
 
         # inline user policy
         mock_iam.put_user_policy(
             UserName=user_name,
             PolicyName="test_iam_createinstanceprofile",
-            PolicyDocument=json.dumps({
-                "Version": "2012-10-17",  # represents version language
-                "Statement": [
-                    {"Effect": "Allow", "Action": "iam:CreateInstanceProfile", "Resource": "*"}
-                ]
-            })
+            PolicyDocument=json.dumps(
+                {
+                    "Version": "2012-10-17",  # represents version language
+                    "Statement": [
+                        {
+                            "Effect": "Allow",
+                            "Action": "iam:CreateInstanceProfile",
+                            "Resource": "*",
+                        }
+                    ],
+                }
+            ),
         )
 
         # group policies
         policy_response = mock_iam.create_policy(
             PolicyName="test_iam_taginstanceprofile",
-            PolicyDocument=json.dumps({
-                "Version": "2012-10-17",  # represents version language
-                "Statement": [
-                    {"Effect": "Allow", "Action": "iam:TagInstanceProfile", "Resource": "*"}
-                ]
-            })
+            PolicyDocument=json.dumps(
+                {
+                    "Version": "2012-10-17",  # represents version language
+                    "Statement": [
+                        {
+                            "Effect": "Allow",
+                            "Action": "iam:TagInstanceProfile",
+                            "Resource": "*",
+                        }
+                    ],
+                }
+            ),
         )
         # attached group policy
         mock_iam.attach_group_policy(
-            GroupName=group_name,
-            PolicyArn=policy_response["Policy"]["Arn"]
+            GroupName=group_name, PolicyArn=policy_response["Policy"]["Arn"]
         )
 
         # inline group policy
         mock_iam.put_group_policy(
             GroupName=group_name,
             PolicyName="test_iam_deleterole",
-            PolicyDocument=json.dumps({
-                "Version": "2012-10-17",  # represents version language
-                "Statement": [
-                    {"Effect": "Allow", "Action": "iam:DeleteRole", "Resource": "*"}
-                ]
-            })
+            PolicyDocument=json.dumps(
+                {
+                    "Version": "2012-10-17",  # represents version language
+                    "Statement": [
+                        {"Effect": "Allow", "Action": "iam:DeleteRole", "Resource": "*"}
+                    ],
+                }
+            ),
         )
 
         actions_collection = iam.get_policy_permissions("us-west-2")
@@ -124,6 +156,42 @@ class IAMTest(ToilTest):
         actions_set = set(actions_collection["*"]["Action"])
         notactions_set = set(actions_collection["*"]["NotAction"])
 
-        expected_actions = {"iam:CreateRole", "iam:CreateInstanceProfile", "iam:TagInstanceProfile", "iam:DeleteRole"}
+        expected_actions = {
+            "iam:CreateRole",
+            "iam:CreateInstanceProfile",
+            "iam:TagInstanceProfile",
+            "iam:DeleteRole",
+        }
         assert actions_set == expected_actions
         assert notactions_set == set()
+
+    def test_create_delete_iam_role(self):
+        region = "us-west-2"
+        role_name = f'test{str(uuid4()).replace("-", "")}'
+        with self.subTest("Create role w/policies."):
+            ec2_role_policy_document = json.dumps(
+                {
+                    "Version": "2012-10-17",
+                    "Statement": [
+                        {
+                            "Effect": "Allow",
+                            "Principal": {"Service": ["ec2.amazonaws.com"]},
+                            "Action": ["sts:AssumeRole"],
+                        }
+                    ],
+                }
+            )
+            policy = dict(
+                s3_deny=dict(
+                    Version="2012-10-17",
+                    Statement=[dict(Effect="Deny", Resource="*", Action="s3:*")],
+                )
+            )
+            iam.create_iam_role(
+                role_name=role_name,
+                assume_role_policy_document=ec2_role_policy_document,
+                policies=policy,
+                region=region,
+            )
+        with self.subTest("Delete role w/policies."):
+            iam.delete_iam_role(role_name=role_name, region=region)

toil/test/lib/aws/test_s3.py

@@ -14,7 +14,7 @@
 import logging
 import os
 import uuid
-from typing import Optional
+from typing import TYPE_CHECKING, Optional
 
 from toil.jobStores.aws.jobStore import AWSJobStore
 from toil.lib.aws.session import establish_boto3_session
@@ -29,11 +29,12 @@ logging.basicConfig(level=logging.DEBUG)
 class S3Test(ToilTest):
     """Confirm the workarounds for us-east-1."""
 
-    from mypy_boto3_s3 import S3ServiceResource
-    from mypy_boto3_s3.service_resource import Bucket
+    if TYPE_CHECKING:
+        from mypy_boto3_s3 import S3ServiceResource
+        from mypy_boto3_s3.service_resource import Bucket
 
-    s3_resource: Optional[S3ServiceResource]
-    bucket: Optional[Bucket]
+    s3_resource: Optional["S3ServiceResource"]
+    bucket: Optional["Bucket"]
 
     @classmethod
     def setUpClass(cls) -> None:
@@ -57,16 +58,22 @@ class S3Test(ToilTest):
         self.assertEqual(get_bucket_region(bucket_name), "us-east-1")
 
         # Make sure all the bucket location getting strategies work on a bucket we created
-        self.assertEqual(get_bucket_region(bucket_name, only_strategies = {1}), "us-east-1")
-        self.assertEqual(get_bucket_region(bucket_name, only_strategies = {2}), "us-east-1")
-        self.assertEqual(get_bucket_region(bucket_name, only_strategies = {3}), "us-east-1")
+        self.assertEqual(
+            get_bucket_region(bucket_name, only_strategies={1}), "us-east-1"
+        )
+        self.assertEqual(
+            get_bucket_region(bucket_name, only_strategies={2}), "us-east-1"
+        )
+        self.assertEqual(
+            get_bucket_region(bucket_name, only_strategies={3}), "us-east-1"
+        )
 
     def test_get_bucket_location_public_bucket(self) -> None:
         """
         Test getting buket location for a bucket we don't own.
         """
 
-        bucket_name = 'spacenet-dataset'
+        bucket_name = "spacenet-dataset"
         # This bucket happens to live in us-east-1
         self.assertEqual(get_bucket_region(bucket_name), "us-east-1")
 

toil/test/lib/aws/test_utils.py

@@ -21,23 +21,25 @@ from toil.test import ToilTest
 logger = logging.getLogger(__name__)
 logging.basicConfig(level=logging.DEBUG)
 
+
 class TagGenerationTest(ToilTest):
     """
     Test for tag generation from environment variables
     """
+
     def test_build_tag(self):
         environment = dict()
         environment["TOIL_OWNER_TAG"] = "😀"
         environment["TOIL_AWS_TAGS"] = None
         tag_dict = build_tag_dict_from_env(environment)
-        assert(tag_dict == {'Owner': '😀'})
+        assert tag_dict == {"Owner": "😀"}
 
     def test_empty_aws_tags(self):
         environment = dict()
         environment["TOIL_OWNER_TAG"] = None
         environment["TOIL_AWS_TAGS"] = "{}"
         tag_dict = build_tag_dict_from_env(environment)
-        assert (tag_dict == dict())
+        assert tag_dict == dict()
 
     def test_incorrect_json_object(self):
         with pytest.raises(SystemExit):
@@ -58,7 +60,4 @@ class TagGenerationTest(ToilTest):
         environment["TOIL_OWNER_TAG"] = "😀"
         environment["TOIL_AWS_TAGS"] = '{"1": "2", " ":")"}'
         tag_dict = build_tag_dict_from_env(environment)
-        assert(tag_dict == {'Owner': '😀', '1': '2', ' ': ')'})
-
-
-
+        assert tag_dict == {"Owner": "😀", "1": "2", " ": ")"}