InstanceAWSProvider implements InstanceProvider { boolean verifyInstanceIdentity(AWSAttestationData info, final String awsAccount) { GetCallerIdentityRequest req = new GetCallerIdentityRequest(); try { AWSSecurityTokenService client = getInstanceClient(info); if (client == null) { LOGGER.error("verifyInstanceIdentity - unable to get AWS STS client object"); return false; } GetCallerIdentityResult res = client.getCallerIdentity(req); if (res == null) { LOGGER.error("verifyInstanceIdentity - unable to get caller identity"); return false; } String arn = "arn:aws:sts::" + awsAccount + ":assumed-role/" + info.getRole() + "/"; if (!res.getArn().startsWith(arn)) { LOGGER.error("verifyInstanceIdentity - ARN mismatch - request: {} caller-idenity: {}", arn, res.getArn()); return false; } return true; } catch (Exception ex) { LOGGER.error("CloudStore: verifyInstanceIdentity - unable get caller identity: {}", ex.getMessage()); return false; } }  @Override Scheme getProviderScheme(); @Override void initialize(String provider, String providerEndpoint, SSLContext sslContext,
            KeyStore keyStore); ResourceException error(String message); ResourceException error(int errorCode, String message); @Override InstanceConfirmation confirmInstance(InstanceConfirmation confirmation); @Override InstanceConfirmation refreshInstance(InstanceConfirmation confirmation);  }
@Test public void testVerifyInstanceIdentityNullClient() { MockInstanceAWSProvider provider = new MockInstanceAWSProvider(); provider.setIdentitySuper(true); AWSAttestationData info = new AWSAttestationData(); assertFalse(provider.verifyInstanceIdentity(info, "1234")); }
@Test public void testVerifyInstanceIdentityNullIdentity() { MockInstanceAWSProvider provider = new MockInstanceAWSProvider(); provider.setIdentitySuper(true); AWSSecurityTokenServiceClient mockClient = Mockito.mock(AWSSecurityTokenServiceClient.class); Mockito.when(mockClient.getCallerIdentity(ArgumentMatchers.any())).thenReturn(null); provider.setStsClient(mockClient); AWSAttestationData info = new AWSAttestationData(); assertFalse(provider.verifyInstanceIdentity(info, "1234")); }
@Test public void testVerifyInstanceIdentityException() { MockInstanceAWSProvider provider = new MockInstanceAWSProvider(); provider.setIdentitySuper(true); AWSSecurityTokenServiceClient mockClient = Mockito.mock(AWSSecurityTokenServiceClient.class); Mockito.when(mockClient.getCallerIdentity(ArgumentMatchers.any())) .thenThrow(new ResourceException(101, "invaliderror")); provider.setStsClient(mockClient); AWSAttestationData info = new AWSAttestationData(); assertFalse(provider.verifyInstanceIdentity(info, "1234")); }
@Test public void testVerifyInstanceIdentityARNMismatch() { MockInstanceAWSProvider provider = new MockInstanceAWSProvider(); provider.setIdentitySuper(true); AWSSecurityTokenServiceClient mockClient = Mockito.mock(AWSSecurityTokenServiceClient.class); GetCallerIdentityResult result = Mockito.mock(GetCallerIdentityResult.class); Mockito.when(result.getArn()).thenReturn("arn:aws:sts::1235:assumed-role/athenz.service/athenz.service"); Mockito.when(mockClient.getCallerIdentity(ArgumentMatchers.any())).thenReturn(result); provider.setStsClient(mockClient); AWSAttestationData info = new AWSAttestationData(); info.setRole("athenz.service"); assertFalse(provider.verifyInstanceIdentity(info, "1234")); }
@Test public void testVerifyInstanceIdentity() { MockInstanceAWSProvider provider = new MockInstanceAWSProvider(); provider.setIdentitySuper(true); AWSSecurityTokenServiceClient mockClient = Mockito.mock(AWSSecurityTokenServiceClient.class); GetCallerIdentityResult result = Mockito.mock(GetCallerIdentityResult.class); Mockito.when(result.getArn()).thenReturn("arn:aws:sts::1234:assumed-role/athenz.service/athenz.service"); Mockito.when(mockClient.getCallerIdentity(ArgumentMatchers.any())).thenReturn(result); provider.setStsClient(mockClient); AWSAttestationData info = new AWSAttestationData(); info.setRole("athenz.service"); assertTrue(provider.verifyInstanceIdentity(info, "1234")); }