@Test public void verifyCredentialTest() throws IOException, AwsPermissionMissingException { URL url = Resources.getResource("definitions/aws-cb-policy.json"); String awsCbPolicy = Resources.toString(url, Charsets.UTF_8); when(awsPlatformParameters.getCredentialPoliciesJson()).thenReturn(Base64.getEncoder().encodeToString(awsCbPolicy.getBytes())); Map<String, Object> awsParameters = new HashMap<>(); awsParameters.put("accessKey", "a"); awsParameters.put("secretKey", "b"); CloudCredential cloudCredential = new CloudCredential("id", "name", awsParameters, false); AmazonIdentityManagement amazonIdentityManagement = mock(AmazonIdentityManagement.class); when(awsClient.createAmazonIdentityManagement(any(AwsCredentialView.class))).thenReturn(amazonIdentityManagement); AWSSecurityTokenService awsSecurityTokenService = mock(AWSSecurityTokenService.class); GetCallerIdentityResult getCallerIdentityResult = new GetCallerIdentityResult(); getCallerIdentityResult.setArn("arn"); when(awsSecurityTokenService.getCallerIdentity(any(GetCallerIdentityRequest.class))).thenReturn(getCallerIdentityResult); when(awsClient.createAwsSecurityTokenService(any(AwsCredentialView.class))).thenReturn(awsSecurityTokenService); ArgumentCaptor<SimulatePrincipalPolicyRequest> requestArgumentCaptor = ArgumentCaptor.forClass(SimulatePrincipalPolicyRequest.class); SimulatePrincipalPolicyResult simulatePrincipalPolicyResult = new SimulatePrincipalPolicyResult(); ArrayList<EvaluationResult> evaluationResults = new ArrayList<>(); evaluationResults.add(new EvaluationResult().withEvalDecision("accept") .withEvalActionName("accepted_action1").withEvalResourceName("aws:ec2")); evaluationResults.add(new EvaluationResult().withEvalDecision("accept") .withEvalActionName("accepted_action2").withEvalResourceName("aws:ec2")); evaluationResults.add(new EvaluationResult().withEvalDecision("accept") .withEvalActionName("accepted_action3").withEvalResourceName("aws:ec2")); evaluationResults.add(new EvaluationResult().withEvalDecision("accept") .withEvalActionName("accepted_action4").withEvalResourceName("*")); simulatePrincipalPolicyResult.setEvaluationResults(evaluationResults); when(amazonIdentityManagement.simulatePrincipalPolicy(requestArgumentCaptor.capture())).thenReturn(simulatePrincipalPolicyResult); awsCredentialVerifier.validateAws(new AwsCredentialView(cloudCredential)); }
@Cacheable(value = AwsCredentialCachingConfig.TEMPORARY_AWS_CREDENTIAL_VERIFIER_CACHE, unless = "#awsCredential == null") public void validateAws(AwsCredentialView awsCredential) throws AwsPermissionMissingException { String policies = new String(Base64.getDecoder().decode(awsPlatformParameters.getCredentialPoliciesJson())); try { Map<String, List<String>> resourcesWithActions = getRequiredActions(policies); AmazonIdentityManagement amazonIdentityManagement = awsClient.createAmazonIdentityManagement(awsCredential); AWSSecurityTokenService awsSecurityTokenService = awsClient.createAwsSecurityTokenService(awsCredential); String arn; if (awsCredential.getRoleArn() != null) { arn = awsCredential.getRoleArn(); } else { GetCallerIdentityResult callerIdentity = awsSecurityTokenService.getCallerIdentity(new GetCallerIdentityRequest()); arn = callerIdentity.getArn(); } List<String> failedActionList = new ArrayList<>(); for (Map.Entry<String, List<String>> resourceAndAction : resourcesWithActions.entrySet()) { SimulatePrincipalPolicyRequest simulatePrincipalPolicyRequest = new SimulatePrincipalPolicyRequest(); simulatePrincipalPolicyRequest.setPolicySourceArn(arn); simulatePrincipalPolicyRequest.setActionNames(resourceAndAction.getValue()); simulatePrincipalPolicyRequest.setResourceArns(Collections.singleton(resourceAndAction.getKey())); SimulatePrincipalPolicyResult simulatePrincipalPolicyResult = amazonIdentityManagement.simulatePrincipalPolicy(simulatePrincipalPolicyRequest); simulatePrincipalPolicyResult.getEvaluationResults().stream() .filter(evaluationResult -> evaluationResult.getEvalDecision().toLowerCase().contains("deny")) .map(evaluationResult -> evaluationResult.getEvalActionName() + ":" + evaluationResult.getEvalResourceName()) .forEach(failedActionList::add); } if (!failedActionList.isEmpty()) { throw new AwsPermissionMissingException(String.format("CDP Credential '%s' doesn't have permission for these actions which are required: %s", awsCredential.getName(), failedActionList)); } } catch (IOException e) { throw new IllegalStateException("Can not parse aws policy json", e); } }
AwsCredentialVerifier { @Cacheable(value = AwsCredentialCachingConfig.TEMPORARY_AWS_CREDENTIAL_VERIFIER_CACHE, unless = "#awsCredential == null") public void validateAws(AwsCredentialView awsCredential) throws AwsPermissionMissingException { String policies = new String(Base64.getDecoder().decode(awsPlatformParameters.getCredentialPoliciesJson())); try { Map<String, List<String>> resourcesWithActions = getRequiredActions(policies); AmazonIdentityManagement amazonIdentityManagement = awsClient.createAmazonIdentityManagement(awsCredential); AWSSecurityTokenService awsSecurityTokenService = awsClient.createAwsSecurityTokenService(awsCredential); String arn; if (awsCredential.getRoleArn() != null) { arn = awsCredential.getRoleArn(); } else { GetCallerIdentityResult callerIdentity = awsSecurityTokenService.getCallerIdentity(new GetCallerIdentityRequest()); arn = callerIdentity.getArn(); } List<String> failedActionList = new ArrayList<>(); for (Map.Entry<String, List<String>> resourceAndAction : resourcesWithActions.entrySet()) { SimulatePrincipalPolicyRequest simulatePrincipalPolicyRequest = new SimulatePrincipalPolicyRequest(); simulatePrincipalPolicyRequest.setPolicySourceArn(arn); simulatePrincipalPolicyRequest.setActionNames(resourceAndAction.getValue()); simulatePrincipalPolicyRequest.setResourceArns(Collections.singleton(resourceAndAction.getKey())); SimulatePrincipalPolicyResult simulatePrincipalPolicyResult = amazonIdentityManagement.simulatePrincipalPolicy(simulatePrincipalPolicyRequest); simulatePrincipalPolicyResult.getEvaluationResults().stream() .filter(evaluationResult -> evaluationResult.getEvalDecision().toLowerCase().contains("deny")) .map(evaluationResult -> evaluationResult.getEvalActionName() + ":" + evaluationResult.getEvalResourceName()) .forEach(failedActionList::add); } if (!failedActionList.isEmpty()) { throw new AwsPermissionMissingException(String.format("CDP Credential '%s' doesn't have permission for these actions which are required: %s", awsCredential.getName(), failedActionList)); } } catch (IOException e) { throw new IllegalStateException("Can not parse aws policy json", e); } } }
AwsCredentialVerifier { @Cacheable(value = AwsCredentialCachingConfig.TEMPORARY_AWS_CREDENTIAL_VERIFIER_CACHE, unless = "#awsCredential == null") public void validateAws(AwsCredentialView awsCredential) throws AwsPermissionMissingException { String policies = new String(Base64.getDecoder().decode(awsPlatformParameters.getCredentialPoliciesJson())); try { Map<String, List<String>> resourcesWithActions = getRequiredActions(policies); AmazonIdentityManagement amazonIdentityManagement = awsClient.createAmazonIdentityManagement(awsCredential); AWSSecurityTokenService awsSecurityTokenService = awsClient.createAwsSecurityTokenService(awsCredential); String arn; if (awsCredential.getRoleArn() != null) { arn = awsCredential.getRoleArn(); } else { GetCallerIdentityResult callerIdentity = awsSecurityTokenService.getCallerIdentity(new GetCallerIdentityRequest()); arn = callerIdentity.getArn(); } List<String> failedActionList = new ArrayList<>(); for (Map.Entry<String, List<String>> resourceAndAction : resourcesWithActions.entrySet()) { SimulatePrincipalPolicyRequest simulatePrincipalPolicyRequest = new SimulatePrincipalPolicyRequest(); simulatePrincipalPolicyRequest.setPolicySourceArn(arn); simulatePrincipalPolicyRequest.setActionNames(resourceAndAction.getValue()); simulatePrincipalPolicyRequest.setResourceArns(Collections.singleton(resourceAndAction.getKey())); SimulatePrincipalPolicyResult simulatePrincipalPolicyResult = amazonIdentityManagement.simulatePrincipalPolicy(simulatePrincipalPolicyRequest); simulatePrincipalPolicyResult.getEvaluationResults().stream() .filter(evaluationResult -> evaluationResult.getEvalDecision().toLowerCase().contains("deny")) .map(evaluationResult -> evaluationResult.getEvalActionName() + ":" + evaluationResult.getEvalResourceName()) .forEach(failedActionList::add); } if (!failedActionList.isEmpty()) { throw new AwsPermissionMissingException(String.format("CDP Credential '%s' doesn't have permission for these actions which are required: %s", awsCredential.getName(), failedActionList)); } } catch (IOException e) { throw new IllegalStateException("Can not parse aws policy json", e); } }  }
AwsCredentialVerifier { @Cacheable(value = AwsCredentialCachingConfig.TEMPORARY_AWS_CREDENTIAL_VERIFIER_CACHE, unless = "#awsCredential == null") public void validateAws(AwsCredentialView awsCredential) throws AwsPermissionMissingException { String policies = new String(Base64.getDecoder().decode(awsPlatformParameters.getCredentialPoliciesJson())); try { Map<String, List<String>> resourcesWithActions = getRequiredActions(policies); AmazonIdentityManagement amazonIdentityManagement = awsClient.createAmazonIdentityManagement(awsCredential); AWSSecurityTokenService awsSecurityTokenService = awsClient.createAwsSecurityTokenService(awsCredential); String arn; if (awsCredential.getRoleArn() != null) { arn = awsCredential.getRoleArn(); } else { GetCallerIdentityResult callerIdentity = awsSecurityTokenService.getCallerIdentity(new GetCallerIdentityRequest()); arn = callerIdentity.getArn(); } List<String> failedActionList = new ArrayList<>(); for (Map.Entry<String, List<String>> resourceAndAction : resourcesWithActions.entrySet()) { SimulatePrincipalPolicyRequest simulatePrincipalPolicyRequest = new SimulatePrincipalPolicyRequest(); simulatePrincipalPolicyRequest.setPolicySourceArn(arn); simulatePrincipalPolicyRequest.setActionNames(resourceAndAction.getValue()); simulatePrincipalPolicyRequest.setResourceArns(Collections.singleton(resourceAndAction.getKey())); SimulatePrincipalPolicyResult simulatePrincipalPolicyResult = amazonIdentityManagement.simulatePrincipalPolicy(simulatePrincipalPolicyRequest); simulatePrincipalPolicyResult.getEvaluationResults().stream() .filter(evaluationResult -> evaluationResult.getEvalDecision().toLowerCase().contains("deny")) .map(evaluationResult -> evaluationResult.getEvalActionName() + ":" + evaluationResult.getEvalResourceName()) .forEach(failedActionList::add); } if (!failedActionList.isEmpty()) { throw new AwsPermissionMissingException(String.format("CDP Credential '%s' doesn't have permission for these actions which are required: %s", awsCredential.getName(), failedActionList)); } } catch (IOException e) { throw new IllegalStateException("Can not parse aws policy json", e); } }  @Cacheable(value = AwsCredentialCachingConfig.TEMPORARY_AWS_CREDENTIAL_VERIFIER_CACHE, unless = "#awsCredential == null") void validateAws(AwsCredentialView awsCredential); }
AwsCredentialVerifier { @Cacheable(value = AwsCredentialCachingConfig.TEMPORARY_AWS_CREDENTIAL_VERIFIER_CACHE, unless = "#awsCredential == null") public void validateAws(AwsCredentialView awsCredential) throws AwsPermissionMissingException { String policies = new String(Base64.getDecoder().decode(awsPlatformParameters.getCredentialPoliciesJson())); try { Map<String, List<String>> resourcesWithActions = getRequiredActions(policies); AmazonIdentityManagement amazonIdentityManagement = awsClient.createAmazonIdentityManagement(awsCredential); AWSSecurityTokenService awsSecurityTokenService = awsClient.createAwsSecurityTokenService(awsCredential); String arn; if (awsCredential.getRoleArn() != null) { arn = awsCredential.getRoleArn(); } else { GetCallerIdentityResult callerIdentity = awsSecurityTokenService.getCallerIdentity(new GetCallerIdentityRequest()); arn = callerIdentity.getArn(); } List<String> failedActionList = new ArrayList<>(); for (Map.Entry<String, List<String>> resourceAndAction : resourcesWithActions.entrySet()) { SimulatePrincipalPolicyRequest simulatePrincipalPolicyRequest = new SimulatePrincipalPolicyRequest(); simulatePrincipalPolicyRequest.setPolicySourceArn(arn); simulatePrincipalPolicyRequest.setActionNames(resourceAndAction.getValue()); simulatePrincipalPolicyRequest.setResourceArns(Collections.singleton(resourceAndAction.getKey())); SimulatePrincipalPolicyResult simulatePrincipalPolicyResult = amazonIdentityManagement.simulatePrincipalPolicy(simulatePrincipalPolicyRequest); simulatePrincipalPolicyResult.getEvaluationResults().stream() .filter(evaluationResult -> evaluationResult.getEvalDecision().toLowerCase().contains("deny")) .map(evaluationResult -> evaluationResult.getEvalActionName() + ":" + evaluationResult.getEvalResourceName()) .forEach(failedActionList::add); } if (!failedActionList.isEmpty()) { throw new AwsPermissionMissingException(String.format("CDP Credential '%s' doesn't have permission for these actions which are required: %s", awsCredential.getName(), failedActionList)); } } catch (IOException e) { throw new IllegalStateException("Can not parse aws policy json", e); } }  @Cacheable(value = AwsCredentialCachingConfig.TEMPORARY_AWS_CREDENTIAL_VERIFIER_CACHE, unless = "#awsCredential == null") void validateAws(AwsCredentialView awsCredential);  }