InstanceAWSProvider implements InstanceProvider { boolean validateAWSDocument(final String provider, AWSAttestationData info, final String awsAccount, final String instanceId, boolean checkTime, StringBuilder privateIp, StringBuilder errMsg) { final String document = info.getDocument(); if (!validateAWSSignature(document, info.getSignature(), errMsg)) { return false; } Struct instanceDocument = JSON.fromString(document, Struct.class); if (instanceDocument == null) { errMsg.append("Unable to parse identity document"); LOGGER.error("Identity Document: {}", document); return false; } if (!validateAWSProvider(provider, instanceDocument.getString(ATTR_REGION), errMsg)) { return false; } if (!validateAWSAccount(awsAccount, instanceDocument.getString(ATTR_ACCOUNT_ID), errMsg)) { return false; } final String infoInstanceId = getInstanceId(info, instanceDocument); if (!validateAWSInstanceId(instanceId, infoInstanceId, errMsg)) { return false; } final String ip = instanceDocument.getString(ATTR_PRIVATE_IP); if (ip != null) { privateIp.append(ip); } return !checkTime || validateInstanceBootTime(instanceDocument, errMsg); }  @Override Scheme getProviderScheme(); @Override void initialize(String provider, String providerEndpoint, SSLContext sslContext,
            KeyStore keyStore); ResourceException error(String message); ResourceException error(int errorCode, String message); @Override InstanceConfirmation confirmInstance(InstanceConfirmation confirmation); @Override InstanceConfirmation refreshInstance(InstanceConfirmation confirmation);  }
@Test public void testValidateAWSDocument() { StringBuilder errMsg = new StringBuilder(256); StringBuilder privateIp = new StringBuilder(64); MockInstanceAWSProvider provider = new MockInstanceAWSProvider(); System.setProperty(InstanceAWSProvider.AWS_PROP_PUBLIC_CERT, "src/test/resources/aws_public.cert"); provider.initialize("provider", "com.yahoo.athenz.instance.provider.impl.InstanceAWSProvider", null, null); String bootTime = Timestamp.fromMillis(System.currentTimeMillis() - 100).toString(); AWSAttestationData data = new AWSAttestationData(); data.setDocument("{\"accountId\": \"1234\",\"pendingTime\": \"" + bootTime + "\",\"region\":\"us-west-2\",\"instanceId\": \"i-1234\"}"); data.setSignature("signature"); assertTrue(provider.validateAWSDocument("athenz.aws.us-west-2", data, "1234", "i-1234", true, privateIp, errMsg)); }
@Test public void testValidateAWSDocumentFailures() { StringBuilder errMsg = new StringBuilder(256); StringBuilder privateIp = new StringBuilder(64); MockInstanceAWSProvider provider = new MockInstanceAWSProvider(); AWSAttestationData data = new AWSAttestationData(); data.setDocument("document"); data.setSignature(null); assertFalse(provider.validateAWSDocument("athenz.aws.us-west-2", data, "cloudAccount", "instanceId", true, privateIp, errMsg)); data.setDocument("document"); data.setSignature("signature"); assertFalse(provider.validateAWSDocument("athenz.aws.us-west-2", data, "cloudAccount", "instanceId", true, privateIp, errMsg)); }