Skip to content
This repository was archived by the owner on Jul 31, 2025. It is now read-only.

Commit 58d6152

Browse files
YakDriverYakDriver
committed
aws/credentials: Add tests for credential_process
1 parent 5278a48 commit 58d6152

File tree

4 files changed

+183
-98
lines changed

4 files changed

+183
-98
lines changed

‎aws/credentials/example.ini‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22
aws_access_key_id = accessKey
33
aws_secret_access_key = secret
44
aws_session_token = token
5-
credential_process = /bin/echo {"Version": 1, "AccessKeyId": "accessKey", "SecretAccessKey": "secret", "SessionToken": "tokenDefault", "Expiration": "2000-01-01T00:00:00-00:00"}
65

76
[no_token]
87
aws_access_key_id = accessKey
@@ -11,6 +10,3 @@ aws_secret_access_key = secret
1110
[with_colon]
1211
aws_access_key_id: accessKey
1312
aws_secret_access_key: secret
14-
15-
[profile process]
16-
credential_process = /bin/echo {"Version": 1, "AccessKeyId": "accessKey", "SecretAccessKey": "secret", "SessionToken": "tokenProcess", "Expiration": "2000-01-01T00:00:00-00:00"}

‎aws/credentials/processcreds/provider_test.go‎

Lines changed: 173 additions & 94 deletions
Original file line numberDiff line numberDiff line change
@@ -1,133 +1,192 @@
1-
package processcreds
1+
package processcreds_test
22

33
import (
4+
"fmt"
45
"os"
5-
"path/filepath"
6+
"runtime"
7+
"strings"
68
"testing"
7-
8-
"github.com/stretchr/testify/assert"
9+
"time"
10+
11+
"github.com/aws/aws-sdk-go/aws"
12+
"github.com/aws/aws-sdk-go/aws/awserr"
13+
"github.com/aws/aws-sdk-go/aws/credentials"
14+
"github.com/aws/aws-sdk-go/aws/credentials/processcreds"
15+
"github.com/aws/aws-sdk-go/aws/session"
16+
"github.com/aws/aws-sdk-go/awstesting"
917
)
1018

11-
func TestProcessProvider(t *testing.T) {
12-
os.Clearenv()
13-
14-
p := ProcessProvider{Filename: "example.ini", Profile: "process", executionFunc: executeCredentialProcess}
15-
creds, err := p.Retrieve()
16-
assert.Nil(t, err, "Expect no error")
19+
func TestProcessProviderFromSession(t *testing.T) {
20+
oldEnv := preserveImportantStashEnv()
21+
defer awstesting.PopEnv(oldEnv)
1722

18-
assert.Equal(t, "accessKey", creds.AccessKeyID, "Expect access key ID to match")
19-
assert.Equal(t, "secret", creds.SecretAccessKey, "Expect secret access key to match")
20-
assert.Equal(t, "tokenProcess", creds.SessionToken, "Expect session token to match")
21-
}
23+
if runtime.GOOS == "windows" {
24+
os.Setenv("AWS_SHARED_CREDENTIALS_FILE", "provider_test_win.ini")
25+
} else {
26+
os.Setenv("AWS_SHARED_CREDENTIALS_FILE", "provider_test.ini")
27+
}
2228

23-
func fakeExectuteCredsExpired(process string) ([]byte, error) {
24-
return []byte(`{"Version": 1, "AccessKeyId": "accessKey", "SecretAccessKey": "secret", "SessionToken": "tokenDefault", "Expiration": "2000-01-01T00:00:00-00:00"}`), nil
25-
}
29+
sess, err := session.NewSession(&aws.Config{
30+
Region: aws.String("region")},
31+
)
2632

27-
func TestProcessProviderIsExpired(t *testing.T) {
28-
os.Clearenv()
33+
if err != nil {
34+
t.Errorf("error getting session: %v", err)
35+
}
2936

30-
p := ProcessProvider{Filename: "example.ini", Profile: "process", executionFunc: fakeExectuteCredsExpired}
37+
creds, err := sess.Config.Credentials.Get()
38+
if err != nil {
39+
t.Errorf("error getting credentials: %v", err)
40+
}
3141

32-
assert.True(t, p.IsExpired(), "Expect creds to be expired before retrieve")
33-
}
42+
if e, a := "accessKey", creds.AccessKeyID; e != a {
43+
t.Errorf("expected %v, got %v", e, a)
44+
}
3445

35-
func TestProcessProviderWithAWS_CONFIG_FILE(t *testing.T) {
36-
os.Clearenv()
37-
os.Setenv("AWS_CONFIG_FILE", "example.ini")
38-
os.Setenv("AWS_DEFAULT_PROFILE", "process")
39-
p := ProcessProvider{Filename: "", Profile: "", executionFunc: executeCredentialProcess}
40-
creds, err := p.Retrieve()
46+
if e, a := "secret", creds.SecretAccessKey; e != a {
47+
t.Errorf("expected %v, got %v", e, a)
48+
}
4149

42-
assert.Nil(t, err, "Expect no error")
50+
if e, a := "tokenDefault", creds.SessionToken; e != a {
51+
t.Errorf("expected %v, got %v", e, a)
52+
}
4353

44-
assert.Equal(t, "accessKey", creds.AccessKeyID, "Expect access key ID to match")
45-
assert.Equal(t, "secret", creds.SecretAccessKey, "Expect secret access key to match")
46-
assert.Equal(t, "tokenProcess", creds.SessionToken, "Expect session token to match")
4754
}
4855

49-
func TestProcessProviderWithAWS_CONFIG_FILEAbsPath(t *testing.T) {
50-
os.Clearenv()
51-
wd, err := os.Getwd()
52-
assert.NoError(t, err)
53-
os.Setenv("AWS_CONFIG_FILE", filepath.Join(wd, "example.ini"))
54-
p := ProcessProvider{executionFunc: executeCredentialProcess}
55-
creds, err := p.Retrieve()
56-
assert.Nil(t, err, "Expect no error")
57-
58-
assert.Equal(t, "accessKey", creds.AccessKeyID, "Expect access key ID to match")
59-
assert.Equal(t, "secret", creds.SecretAccessKey, "Expect secret access key to match")
60-
assert.Equal(t, "tokenDefault", creds.SessionToken, "Expect session token to match")
61-
}
56+
func TestProcessProviderFromSessionWithProfile(t *testing.T) {
57+
oldEnv := preserveImportantStashEnv()
58+
defer awstesting.PopEnv(oldEnv)
6259

63-
func fakeExectuteCredsSuccess(process string) ([]byte, error) {
64-
return []byte(`{"Version": 1, "AccessKeyId": "accessKey", "SecretAccessKey": "secret", "SessionToken": "tokenFake", "Expiration": "2000-01-01T00:00:00-00:00"}`), nil
65-
}
60+
if runtime.GOOS == "windows" {
61+
os.Setenv("AWS_SHARED_CREDENTIALS_FILE", "provider_test_win.ini")
62+
} else {
63+
os.Setenv("AWS_SHARED_CREDENTIALS_FILE", "provider_test.ini")
64+
}
65+
os.Setenv("AWS_PROFILE", "non_expire")
6666

67-
func TestProcessProviderWithAWS_PROFILE(t *testing.T) {
68-
os.Clearenv()
69-
os.Setenv("AWS_PROFILE", "process")
67+
sess, err := session.NewSession(&aws.Config{
68+
Region: aws.String("region")},
69+
)
7070

71-
p := ProcessProvider{Filename: "example.ini", Profile: "", executionFunc: fakeExectuteCredsSuccess}
72-
creds, err := p.Retrieve()
73-
assert.Nil(t, err, "Expect no error")
71+
if err != nil {
72+
t.Errorf("error getting session: %v", err)
73+
}
7474

75-
assert.Equal(t, "accessKey", creds.AccessKeyID, "Expect access key ID to match")
76-
assert.Equal(t, "secret", creds.SecretAccessKey, "Expect secret access key to match")
77-
assert.Equal(t, "tokenFake", creds.SessionToken, "Expect token to match")
78-
}
75+
creds, err := sess.Config.Credentials.Get()
76+
if err != nil {
77+
t.Errorf("error getting credentials: %v", err)
78+
}
79+
80+
if e, a := "nonDefaultToken", creds.SessionToken; e != a {
81+
t.Errorf("expected %v, got %v", e, a)
82+
}
7983

80-
func fakeExectuteCredsFailMalformed(process string) ([]byte, error) {
81-
return []byte(`{"Version": 1, "AccessKeyId": "accessKey", "SecretAccessKey": "secret", "SessionToken": "tokenDefault", "Expiration": `), nil
8284
}
8385

84-
func TestProcessProviderMalformed(t *testing.T) {
85-
os.Clearenv()
86-
os.Setenv("AWS_PROFILE", "process")
86+
func TestProcessProviderExpectErrors(t *testing.T) {
87+
oldEnv := preserveImportantStashEnv()
88+
defer awstesting.PopEnv(oldEnv)
8789

88-
p := ProcessProvider{Filename: "example.ini", Profile: "", executionFunc: fakeExectuteCredsFailMalformed}
89-
_, err := p.Retrieve()
90-
assert.NotNil(t, err, "Expect an error")
91-
}
90+
creds := credentials.NewCredentials(&processcreds.ProcessProvider{
91+
Process: "/bad/process",
92+
})
93+
_, err := creds.Get()
9294

93-
func fakeExectuteCredsNoToken(process string) ([]byte, error) {
94-
return []byte(`{"Version": 1, "AccessKeyId": "accessKey", "SecretAccessKey": "secret"}`), nil
95-
}
95+
if err.(awserr.Error).Code() != processcreds.ErrCodeProcessProviderExecution {
96+
t.Errorf("expected %v, got %v", processcreds.ErrCodeProcessProviderExecution, err)
97+
}
9698

97-
func TestProcessProviderNoToken(t *testing.T) {
98-
os.Clearenv()
99+
process := fixForOS("echo {\\\"Version\\\": 1")
100+
p := &processcreds.ProcessProvider{
101+
Process: process,
102+
}
103+
_, err = p.Retrieve()
104+
if err.(awserr.Error).Code() != processcreds.ErrCodeProcessProviderParse {
105+
t.Errorf("expected %v, got %v", processcreds.ErrCodeProcessProviderParse, err)
106+
}
99107

100-
p := ProcessProvider{Filename: "example.ini", Profile: "process", executionFunc: fakeExectuteCredsNoToken}
101-
creds, err := p.Retrieve()
102-
assert.Nil(t, err, "Expect no error")
103-
assert.Empty(t, creds.SessionToken, "Expect no token")
104-
}
108+
process = fixForOS("echo {\\\"Version\\\": 2}")
109+
p = &processcreds.ProcessProvider{
110+
Process: process,
111+
}
112+
_, err = p.Retrieve()
113+
if err.(awserr.Error).Code() != processcreds.ErrCodeProcessProviderVersion {
114+
t.Errorf("expected %v, got %v", processcreds.ErrCodeProcessProviderVersion, err)
115+
}
105116

106-
func fakeExectuteCredsFailVersion(process string) ([]byte, error) {
107-
return []byte(`{"Version": 2, "AccessKeyId": "accessKey", "SecretAccessKey": "secret", "SessionToken": "tokenDefault"}`), nil
108-
}
117+
process = fixForOS("echo {\\\"Version\\\": 1, \\\"AccessKeyId\\\": \\\"accesskey\\\"}")
118+
p = &processcreds.ProcessProvider{
119+
Process: process,
120+
}
121+
_, err = p.Retrieve()
122+
if err.(awserr.Error).Code() != processcreds.ErrCodeProcessProviderRequired {
123+
t.Errorf("expected %v, got %v", processcreds.ErrCodeProcessProviderRequired, err)
124+
}
109125

110-
func TestProcessProviderWrongVersion(t *testing.T) {
111-
os.Clearenv()
112-
p := ProcessProvider{Filename: "example.ini", Profile: "process", executionFunc: fakeExectuteCredsFailVersion}
113-
_, err := p.Retrieve()
114-
assert.NotNil(t, err, "Expect an error")
126+
process = fixForOS("echo {\\\"Version\\\": 1, \\\"SecretAccessKey\\\": \\\"secretkey\\\"}")
127+
p = &processcreds.ProcessProvider{
128+
Process: process,
129+
}
130+
_, err = p.Retrieve()
131+
if err.(awserr.Error).Code() != processcreds.ErrCodeProcessProviderRequired {
132+
t.Errorf("expected %v, got %v", processcreds.ErrCodeProcessProviderRequired, err)
133+
}
115134
}
116135

117-
func fakeExectuteCredsFailExpiration(process string) ([]byte, error) {
118-
return []byte(`{"Version": 1, "AccessKeyId": "accessKey", "SecretAccessKey": "secret", "SessionToken": "tokenDefault", "Expiration": "20222"}`), nil
119-
}
120-
func TestProcessProviderBadExpiry(t *testing.T) {
121-
os.Clearenv()
122-
p := ProcessProvider{Filename: "example.ini", Profile: "process", executionFunc: fakeExectuteCredsFailExpiration}
136+
func TestProcessProviderExpiration(t *testing.T) {
137+
oldEnv := preserveImportantStashEnv()
138+
defer awstesting.PopEnv(oldEnv)
139+
140+
// static creds
141+
process := fixForOS("echo {\\\"Version\\\": 1, \\\"SecretAccessKey\\\": \\\"secretkey\\\", \\\"AccessKeyId\\\": \\\"accesskey\\\"}")
142+
p := &processcreds.ProcessProvider{
143+
Process: process,
144+
}
123145
_, err := p.Retrieve()
124-
assert.NotNil(t, err, "Expect an error")
146+
if err != nil {
147+
t.Errorf("expected %v, got %v", "no error", err)
148+
}
149+
if p.IsExpired() {
150+
t.Errorf("expected %v, got %v", "static credentials/not expired", "expired")
151+
}
152+
153+
// not expired creds
154+
future := time.Now().Add(1 * time.Hour).UTC().Format(time.RFC3339)
155+
process = fixForOS(fmt.Sprintf("echo {\\\"Version\\\": 1, \\\"SecretAccessKey\\\": \\\"secretkey\\\", \\\"AccessKeyId\\\": \\\"accesskey\\\", \\\"Expiration\\\": \\\"%v\\\"}", future))
156+
p = &processcreds.ProcessProvider{
157+
Process: process,
158+
}
159+
_, err = p.Retrieve()
160+
if err != nil {
161+
t.Errorf("expected %v, got %v", "no error", err)
162+
}
163+
if p.IsExpired() {
164+
t.Errorf("expected %v, got %v", "not expired", "expired")
165+
}
166+
167+
// expired creds
168+
past := time.Now().Add(-1 * time.Hour).UTC().Format(time.RFC3339)
169+
process = fixForOS(fmt.Sprintf("echo {\\\"Version\\\": 1, \\\"SecretAccessKey\\\": \\\"secretkey\\\", \\\"AccessKeyId\\\": \\\"accesskey\\\", \\\"Expiration\\\": \\\"%v\\\"}", past))
170+
p = &processcreds.ProcessProvider{
171+
Process: process,
172+
}
173+
_, err = p.Retrieve()
174+
if err != nil {
175+
t.Errorf("expected %v, got %v", "no error", err)
176+
}
177+
if !p.IsExpired() {
178+
t.Errorf("expected %v, got %v", "expired", "not expired")
179+
}
125180
}
126181

127182
func BenchmarkProcessProvider(b *testing.B) {
128-
os.Clearenv()
183+
oldEnv := preserveImportantStashEnv()
184+
defer awstesting.PopEnv(oldEnv)
129185

130-
p := ProcessProvider{Filename: "example.ini", Profile: "process", executionFunc: executeCredentialProcess}
186+
process := fixForOS("echo {\\\"Version\\\": 1, \\\"SecretAccessKey\\\": \\\"secretkey\\\", \\\"AccessKeyId\\\": \\\"accesskey\\\"}")
187+
p := &processcreds.ProcessProvider{
188+
Process: process,
189+
}
131190
_, err := p.Retrieve()
132191
if err != nil {
133192
b.Fatal(err)
@@ -141,3 +200,23 @@ func BenchmarkProcessProvider(b *testing.B) {
141200
}
142201
}
143202
}
203+
204+
func preserveImportantStashEnv() []string {
205+
var comspec string
206+
if len(os.Getenv("ComSpec")) != 0 {
207+
comspec = os.Getenv("ComSpec")
208+
}
209+
210+
oldEnv := awstesting.StashEnv() //clear env
211+
212+
os.Setenv("ComSpec", comspec)
213+
return oldEnv
214+
}
215+
216+
func fixForOS(in string) string {
217+
if runtime.GOOS == "windows" {
218+
return strings.Replace(in, "\\", "", -1)
219+
}
220+
221+
return in
222+
}

‎aws/credentials/processcreds/provider_test.ini‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
[default]
2+
credential_process = echo {\"Version\": 1, \"AccessKeyId\": \"accessKey\", \"SecretAccessKey\": \"secret\", \"SessionToken\": \"tokenDefault\", \"Expiration\": \"2000-01-01T00:00:00-00:00\"}
3+
4+
[profile non_expire]
5+
credential_process = echo {\"Version\": 1, \"AccessKeyId\": \"accessKey\", \"SecretAccessKey\": \"secret\", \"SessionToken\": \"nonDefaultToken\"}

‎aws/credentials/processcreds/provider_test_win.ini‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
[default]
2+
credential_process = echo {"Version": 1, "AccessKeyId": "accessKey", "SecretAccessKey": "secret", "SessionToken": "tokenDefault", "Expiration": "2000-01-01T00:00:00-00:00"}
3+
4+
[profile non_expire]
5+
credential_process = echo {"Version": 1, "AccessKeyId": "accessKey", "SecretAccessKey": "secret", "SessionToken": "nonDefaultToken"}

0 commit comments

Comments
 (0)