AWSAuthService { public ResponseEntity<String> updateRole(String token, AWSLoginRole awsLoginRole) throws TVaultValidationException{ if (!ControllerUtil.areAWSEC2RoleInputsValid(awsLoginRole)) { throw new TVaultValidationException("Invalid inputs for the given aws login type"); } String jsonStr = JSONUtil.getJSON(awsLoginRole); ObjectMapper objMapper = new ObjectMapper(); String currentPolicies = ""; String latestPolicies = ""; String roleName = "" ; try { JsonNode root = objMapper.readTree(jsonStr); roleName = root.get("role").asText(); if(root.get("policies") != null) latestPolicies = root.get("policies").asText(); } catch (IOException e) { logger.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Update AWS role"). put(LogMessage.MESSAGE, String.format("Failed to extract role/policies from json string [%s]", jsonStr)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } Response awsResponse = reqProcessor.process("/auth/aws/roles","{\"role\":\""+roleName+"\"}",token); String responseJson=""; if(HttpStatus.OK.equals(awsResponse.getHttpstatus())){ responseJson = awsResponse.getResponse(); try { Map<String,Object> responseMap; responseMap = objMapper.readValue(responseJson, new TypeReference<Map<String, Object>>(){}); @SuppressWarnings("unchecked") List<String> policies = (List<String>) responseMap.get("policies"); currentPolicies = policies.stream().collect(Collectors.joining(",")).toString(); } catch (IOException e) { logger.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Update AWS role"). put(LogMessage.MESSAGE, "Failed to extract from AWS read response"). put(LogMessage.RESPONSE, awsResponse.getResponse()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } }else{ return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"messages\":[\"Update failed . AWS Role does not exist \"]}"); } Response response = reqProcessor.process("/auth/aws/roles/delete",jsonStr,token); if(response.getHttpstatus().equals(HttpStatus.NO_CONTENT)){ response = reqProcessor.process("/auth/aws/roles/update",jsonStr,token); if(response.getHttpstatus().equals(HttpStatus.NO_CONTENT)){ response = ControllerUtil.updateMetaDataOnConfigChanges(roleName, "aws-roles", currentPolicies, latestPolicies, token); if(!HttpStatus.OK.equals(response.getHttpstatus())) return ResponseEntity.status(response.getHttpstatus()).body("{\"messages\":[\"AWS Role configured\",\""+response.getResponse()+"\"]}"); return ResponseEntity.status(HttpStatus.OK).body("{\"messages\":[\"AWS Role updated \"]}"); }else{ return ResponseEntity.status(response.getHttpstatus()).body(response.getResponse()); } }else{ return ResponseEntity.status(response.getHttpstatus()).body(response.getResponse()); } }  ResponseEntity<String> authenticateEC2(AWSLogin login); ResponseEntity<String> createRole(String token, AWSLoginRole awsLoginRole, UserDetails userDetails); ResponseEntity<String> updateRole(String token, AWSLoginRole awsLoginRole); ResponseEntity<String> deleteRole(String token, String role, UserDetails userDetails); ResponseEntity<String> fetchRole(String token, String role); ResponseEntity<String> listRoles(String token); ResponseEntity<String> configureClient(AWSClientConfiguration awsClientConfiguration, String token); ResponseEntity<String> readClientConfiguration(String token); ResponseEntity<String> createSTSRole(AWSStsRole awsStsRole, String token); ResponseEntity<String> authenticateIAM(AWSIAMLogin awsiamLogin); ResponseEntity<String> authenticate(AWSAuthType authType, AWSAuthLogin awsAuthLogin); Response configureAWSRole(String roleName,String policies,String token );  }
@Test public void test_updateRole_successfully() { Response response = new Response(); response.setHttpstatus(HttpStatus.OK); String roleName = "mytestawsrole"; String responseBody = "{ \"bound_account_id\": [ \"1234567890123\"],\"bound_ami_id\": [\"ami-fce3c696\" ], \"bound_iam_instance_profile_arn\": [\n" + " \"arn:aws:iam::877677878:instance-profile/exampleinstanceprofile\" ], \"bound_iam_role_arn\": [\"arn:aws:iam::8987887:role/test-role\" ], " + "\"bound_vpc_id\": [ \"vpc-2f09a348\"], \"bound_subnet_id\": [ \"subnet-1122aabb\"],\"bound_region\": [\"us-east-2\"],\"policies\": [ \"\\\"[prod\",\"dev\\\"]\" ]}"; Response readResponse = getMockResponse(HttpStatus.OK, true, responseBody); Response responseNoContent = getMockResponse(HttpStatus.NO_CONTENT, true, ""); String token = "5PDrOhsy4ig8L3EpsJZSLAMg"; AWSLoginRole awsLoginRole = new AWSLoginRole("ec2", "mytestawsrole", "ami-fce3c696", "1234567890123", "us-east-2", "vpc-2f09a348", "subnet-1122aabb", "arn:aws:iam::8987887:role/test-role", "arn:aws:iam::877677878:instance-profile/exampleinstanceprofile", "\"[prod, dev\"]"); String jsonStr = "{\"auth_type\": \"ec2\", \"role\": \"mytestawsrole\", \"bound_ami_id\": \"ami-fce3c696\", " + "\"bound_account_id\": 1234567890123, \"bound_region\": \"us-east-2\",\"bound_vpc_id\": " + "\"vpc-2f09a348\", \"bound_subnet_id\": \"subnet-1122aabb\", \"bound_iam_role_arn\": " + "\"arn:aws:iam::8987887:role/test-role\", \"bound_iam_instance_profile_arn\":" + "\"arn:aws:iam::877677878:instance-profile/exampleinstanceprofile\", " + "\"policies\": \"\\\"[prod, dev\\\"]\"}"; ResponseEntity<String> responseEntityExpected = ResponseEntity.status(HttpStatus.OK).body("{\"messages\":[\"AWS Role updated \"]}"); when(reqProcessor.process("/auth/aws/roles", "{\"role\":\"" + roleName + "\"}", token)).thenReturn(readResponse); when(reqProcessor.process("/auth/aws/roles/delete", jsonStr, token)).thenReturn(responseNoContent); when(reqProcessor.process("/auth/aws/roles/update", jsonStr, token)).thenReturn(responseNoContent); when(ControllerUtil.updateMetaDataOnConfigChanges(Mockito.anyString(), Mockito.anyString(), Mockito.anyString(), Mockito.anyString(), Mockito.anyString())).thenReturn(response); when(JSONUtil.getJSON(awsLoginRole)).thenReturn(jsonStr); ResponseEntity<String> responseEntity = null; try { when(ControllerUtil.areAWSEC2RoleInputsValid(awsLoginRole)).thenReturn(true); responseEntity = awsAuthService.updateRole(token, awsLoginRole); } catch (TVaultValidationException e) { e.printStackTrace(); } assertEquals(HttpStatus.OK, responseEntity.getStatusCode()); assertEquals(responseEntityExpected, responseEntity); }
@Test(expected = TVaultValidationException.class) public void test_updateRole_failure_400() throws TVaultValidationException{ Response response = new Response(); response.setHttpstatus(HttpStatus.OK); String token = "5PDrOhsy4ig8L3EpsJZSLAMg"; AWSLoginRole awsLoginRole = new AWSLoginRole("ec2", "mytestawsrole", "ami-fce3c696", "1234567890123", "us-east-2", "vpc-2f09a348", "subnet-1122aabb", "arn:aws:iam::8987887:role/test-role", "arn:aws:iam::877677878:instance-profile/exampleinstanceprofile", "\"[prod, dev\"]"); ResponseEntity<String> responseEntity = null; when(ControllerUtil.areAWSEC2RoleInputsValid(awsLoginRole)).thenReturn(false); responseEntity = awsAuthService.updateRole(token, awsLoginRole); }
@Test public void test_updateRole_failure_404() { Response response = new Response(); response.setHttpstatus(HttpStatus.OK); String roleName = "mytestawsrole"; Response responseError = getMockResponse(HttpStatus.BAD_REQUEST, true, "{\"messages\":[\"Update failed . AWS Role does not exist \"]}"); String token = "5PDrOhsy4ig8L3EpsJZSLAMg"; AWSLoginRole awsLoginRole = new AWSLoginRole("ec2", "mytestawsrole", "ami-fce3c696", "1234567890123", "us-east-2", "vpc-2f09a348", "subnet-1122aabb", "arn:aws:iam::8987887:role/test-role", "arn:aws:iam::877677878:instance-profile/exampleinstanceprofile", "\"[prod, dev\"]"); String jsonStr = "{\"auth_type\": \"ec2\", \"role\": \"mytestawsrole\", \"bound_ami_id\": \"ami-fce3c696\", " + "\"bound_account_id\": 1234567890123, \"bound_region\": \"us-east-2\",\"bound_vpc_id\": " + "\"vpc-2f09a348\", \"bound_subnet_id\": \"subnet-1122aabb\", \"bound_iam_role_arn\": " + "\"arn:aws:iam::8987887:role/test-role\", \"bound_iam_instance_profile_arn\":" + "\"arn:aws:iam::877677878:instance-profile/exampleinstanceprofile\", " + "\"policies\": \"\\\"[prod, dev\\\"]\"}"; ResponseEntity<String> responseEntityExpected = ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"messages\":[\"Update failed . AWS Role does not exist \"]}"); when(reqProcessor.process("/auth/aws/roles", "{\"role\":\"" + roleName + "\"}", token)).thenReturn(responseError); when(JSONUtil.getJSON(awsLoginRole)).thenReturn(jsonStr); ResponseEntity<String> responseEntity = null; try { when(ControllerUtil.areAWSEC2RoleInputsValid(awsLoginRole)).thenReturn(true); responseEntity = awsAuthService.updateRole(token, awsLoginRole); } catch (TVaultValidationException e) { e.printStackTrace(); } assertEquals(HttpStatus.BAD_REQUEST, responseEntity.getStatusCode()); assertEquals(responseEntityExpected, responseEntity); }