InstanceAWSProvider implements InstanceProvider { @Override public InstanceConfirmation confirmInstance(InstanceConfirmation confirmation) { AWSAttestationData info = JSON.fromString(confirmation.getAttestationData(), AWSAttestationData.class); final Map<String, String> instanceAttributes = confirmation.getAttributes(); final String instanceDomain = confirmation.getDomain(); final String instanceService = confirmation.getService(); final String awsAccount = InstanceUtils.getInstanceProperty(instanceAttributes, ZTS_INSTANCE_AWS_ACCOUNT); if (awsAccount == null) { throw error("Unable to extract AWS Account id"); } final String serviceName = instanceDomain + "." + instanceService; if (!serviceName.equals(info.getRole())) { throw error("Service name mismatch: " + info.getRole() + " vs. " + serviceName); } StringBuilder instanceId = new StringBuilder(256); if (!InstanceUtils.validateCertRequestSanDnsNames(instanceAttributes, instanceDomain, instanceService, dnsSuffix, instanceId)) { throw error("Unable to validate certificate request hostnames"); } boolean instanceDocumentCreds = info.getDocument() != null; StringBuilder privateIp = new StringBuilder(64); if (instanceDocumentCreds) { StringBuilder errMsg = new StringBuilder(256); if (!validateAWSDocument(confirmation.getProvider(), info, awsAccount, instanceId.toString(), true, privateIp, errMsg)) { LOGGER.error("validateAWSDocument: {}", errMsg.toString()); throw error("Unable to validate AWS document: " + errMsg.toString()); } } setConfirmationAttributes(confirmation, instanceDocumentCreds, privateIp.toString()); if (!verifyInstanceIdentity(info, awsAccount)) { throw error("Unable to verify instance identity credentials"); } return confirmation; }  @Override Scheme getProviderScheme(); @Override void initialize(String provider, String providerEndpoint, SSLContext sslContext,
            KeyStore keyStore); ResourceException error(String message); ResourceException error(int errorCode, String message); @Override InstanceConfirmation confirmInstance(InstanceConfirmation confirmation); @Override InstanceConfirmation refreshInstance(InstanceConfirmation confirmation);  }
@Test public void testConfirmInstance() { System.setProperty(InstanceAWSProvider.AWS_PROP_DNS_SUFFIX, "athenz.cloud"); MockInstanceAWSProvider provider = new MockInstanceAWSProvider(); System.setProperty(InstanceAWSProvider.AWS_PROP_PUBLIC_CERT, "src/test/resources/aws_public.cert"); provider.initialize("provider", "com.yahoo.athenz.instance.provider.impl.InstanceAWSProvider", null, null); String bootTime = Timestamp.fromMillis(System.currentTimeMillis() - 100).toString(); InstanceConfirmation confirmation = new InstanceConfirmation() .setAttestationData("{\"document\": \"{\\\"accountId\\\": \\\"1234\\\",\\\"pendingTime\\\": \\\"" + bootTime + "\\\",\\\"region\\\": \\\"us-west-2\\\",\\\"instanceId\\\": \\\"i-1234\\\"," + "\\\"privateIp\\\": \\\"10.10.10.11\\\"}\"," + "\"signature\": \"signature\",\"role\": \"athenz.service\"}") .setDomain("athenz").setProvider("athenz.aws.us-west-2").setService("service"); HashMap<String, String> attributes = new HashMap<>(); attributes.put("cloudAccount", "1234"); attributes.put("sanDNS", "service.athenz.athenz.cloud,i-1234.instanceid.athenz.athenz.cloud"); confirmation.setAttributes(attributes); InstanceConfirmation result = provider.confirmInstance(confirmation); assertEquals(result.getDomain(), "athenz"); Map<String, String> attrs = result.getAttributes(); assertNotNull(attrs); assertEquals(attrs.get("certSSH"), "true"); assertEquals(attrs.get("instancePrivateIp"), "10.10.10.11"); assertNull(attrs.get("certExpiryTime")); System.clearProperty(InstanceAWSProvider.AWS_PROP_DNS_SUFFIX); }