DataCache { void processAWSAssumeRoleAssertion(Assertion assertion) { if (LOGGER.isDebugEnabled()) { LOGGER.debug("Processing AWS Assume Role for resource: {} and role: {}", assertion.getResource(), assertion.getRole()); } if (assertion.getEffect() == AssertionEffect.DENY) { return; } final String role = assertion.getRole(); if (!awsRoleCache.containsKey(role)) { awsRoleCache.put(role, new HashSet<>()); } final Set<String> resourcesForRole = awsRoleCache.get(role); resourcesForRole.add(assertion.getResource()); } DataCache(); void setDomainData(DomainData domainData); DomainData getDomainData(); void processRole(Role role); void processPolicy(String domainName, Policy policy, Map<String, Role> roles); void processServiceIdentity(com.yahoo.athenz.zms.ServiceIdentity service); Set<MemberRole> getMemberRoleSet(final String member); List<String> getProviderDnsSuffixList(final String provider); List<String> getProviderHostnameAllowedSuffixList(final String provider); List<String> getProviderHostnameDeniedSuffixList(final String provider); Set<MemberRole> getAllMemberRoleSet(); Map<String, Set<MemberRole>> getPrefixMemberRoleSetMap(); int getMemberCount(); Set<String> getAWSResourceRoleSet(String role); RoleMeta getRoleMeta(String role); Map<String, Set<String>> getTrustMap(); Map<String, Set<String>> getHostMap(); Map<String, String> getPublicKeyMap(); Map<String, List<String>> getProviderDnsSuffixCache(); Map<String, List<String>> getProviderHostnameAllowedSuffixCache(); Map<String, List<String>> getProviderHostnameDeniedSuffixCache(); static final String ACTION_ASSUME_ROLE; static final String ACTION_ASSUME_AWS_ROLE; static final String ACTION_LAUNCH; static final String RESOURCE_DNS_PREFIX; static final String RESOURCE_HOSTNAME_PREFIX; }
@Test public void testProcessAWSAssumeRoleAssertion() { DataCache cache = new DataCache(); assertNull(cache.getAWSResourceRoleSet("role")); Assertion assertion = new Assertion(); assertion.setAction("assume_aws_role"); assertion.setResource("resource"); assertion.setRole("role"); cache.processAWSAssumeRoleAssertion(assertion); Set<String> set = cache.getAWSResourceRoleSet("role"); assertEquals(1, set.size()); cache.processAWSAssumeRoleAssertion(assertion); set = cache.getAWSResourceRoleSet("role"); assertEquals(1, set.size()); Assertion assertion2 = new Assertion(); assertion2.setAction("assume_aws_role"); assertion2.setResource("resource2"); assertion2.setRole("role"); assertion2.setEffect(AssertionEffect.DENY); cache.processAWSAssumeRoleAssertion(assertion2); set = cache.getAWSResourceRoleSet("role"); assertEquals(1, set.size()); Assertion assertion3 = new Assertion(); assertion3.setAction("assume_aws_role"); assertion3.setResource("resource3"); assertion3.setRole("role"); assertion3.setEffect(AssertionEffect.ALLOW); cache.processAWSAssumeRoleAssertion(assertion3); set = cache.getAWSResourceRoleSet("role"); assertEquals(2, set.size()); assertTrue(set.contains("resource")); assertTrue(set.contains("resource3")); }