Skip to content

Commit 1df1eb8

Browse files
outcomes-winter-rakhulsprakashoutcomes-winter-rakhulsprakash
committed
Add valid iamroleId for cfn tests
1 parent 920d4aa commit 1df1eb8

7 files changed

Lines changed: 163 additions & 31 deletions

File tree

‎.gitignore‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,3 +48,8 @@ CLAUDE.md
4848

4949
# generated markdown file with resource versions, will not be commited until we have mechanism to keep updated
5050
cfn-resources/resource-versions.md
51+
52+
# dynamically generated test policy files (not templates)
53+
**/test/trust-policy.json
54+
**/test/s3-policy.json
55+
**/test/add-policy.json

‎cfn-resources/log-integration/test/cfn-test-create-inputs.sh‎

Lines changed: 78 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -2,35 +2,45 @@
22
# cfn-test-create-inputs.sh
33
#
44
# This tool generates json files in the inputs/ for `cfn test`.
5+
# It creates all required AWS resources (S3 bucket, IAM role, Cloud Provider Access role)
56
#
67

78
set -o errexit
89
set -o nounset
910
set -o pipefail
1011

1112
function usage {
12-
echo "usage:$0 <project_name> <bucket_name> <iam_role_id>"
13-
echo "Generates test input files for log integration"
13+
echo "usage: $0 <project_name>"
14+
echo "Creates S3 bucket, Cloud Provider Access role, IAM role, and generates test input files for log integration"
1415
exit 0
1516
}
1617

17-
if [ "$#" -ne 3 ]; then usage; fi
18+
if [ "$#" -ne 1 ]; then usage; fi
1819
if [[ "$*" == help ]]; then usage; fi
1920

20-
rm -rf inputs
21-
mkdir inputs
21+
region=$AWS_DEFAULT_REGION
22+
awsRegion=$AWS_DEFAULT_REGION
23+
if [ -z "$region" ]; then
24+
region=$(aws configure get region)
25+
awsRegion=$region
26+
fi
27+
28+
regionFormatted=$(echo "$region" | sed -e "s/-/_/g" | tr '[:lower:]' '[:upper:]')
29+
echo "Using region: $region (formatted: $regionFormatted)"
30+
31+
roleName="mongodb-atlas-logs-role-${regionFormatted}"
32+
policyName="atlas-logs-s3-policy-${regionFormatted}"
33+
bucketTag="${CFN_TEST_TAG:-$(date +%Y%m%d%H%M%S)}"
34+
bucketName="mongodb-atlas-cfn-test-logs-${bucketTag}"
2235

23-
#set profile - relevant for contract tests which define a custom profile
36+
echo "Bucket name: ${bucketName}"
2437
profile="default"
2538
if [ ${MONGODB_ATLAS_PROFILE+x} ]; then
2639
echo "profile set to ${MONGODB_ATLAS_PROFILE}"
2740
profile=${MONGODB_ATLAS_PROFILE}
2841
fi
2942

3043
projectName="${1}"
31-
bucketName="${2}"
32-
iamRoleId="${3}"
33-
3444
projectId=$(atlas projects list --output json | jq --arg NAME "${projectName}" -r '.results[] | select(.name==$NAME) | .id')
3545
if [ -z "$projectId" ]; then
3646
projectId=$(atlas projects create "${projectName}" --output=json | jq -r '.id')
@@ -39,16 +49,72 @@ else
3949
echo -e "FOUND project \"${projectName}\" with id: ${projectId}\n"
4050
fi
4151

42-
echo "bucketName: $bucketName"
43-
echo "iamRoleId: $iamRoleId"
52+
echo "--------------------------------Creating Cloud Provider Access Role----------------------------"
53+
roleID=$(atlas cloudProviders accessRoles aws create --projectId "${projectId}" --output json | jq -r '.roleId')
54+
echo "--------------------------------Mongo CLI Role creation ends----------------------------"
55+
56+
atlasAWSAccountArn=$(atlas cloudProviders accessRoles list --projectId "${projectId}" --output json | jq --arg roleID "${roleID}" -r '.awsIamRoles[] | select(.roleId == $roleID) | .atlasAWSAccountArn')
57+
atlasAssumedRoleExternalId=$(atlas cloudProviders accessRoles list --projectId "${projectId}" --output json | jq --arg roleID "${roleID}" -r '.awsIamRoles[] | select(.roleId == $roleID) | .atlasAssumedRoleExternalId')
58+
59+
jq --arg atlasAssumedRoleExternalId "$atlasAssumedRoleExternalId" \
60+
--arg atlasAWSAccountArn "$atlasAWSAccountArn" \
61+
'.Statement[0].Principal.AWS = $atlasAWSAccountArn | .Statement[0].Condition.StringEquals["sts:ExternalId"] = $atlasAssumedRoleExternalId' \
62+
"$(dirname "$0")/role-policy-template.json" >"$(dirname "$0")/trust-policy.json"
63+
echo "--------------------------------AWS Role creation starts----------------------------"
64+
awsRoleID=$(aws iam get-role --role-name "${roleName}" 2>/dev/null | jq -r '.Role.RoleId' || echo "")
65+
if [ -z "$awsRoleID" ]; then
66+
awsRoleID=$(aws iam create-role \
67+
--role-name "${roleName}" \
68+
--assume-role-policy-document "file://$(dirname "$0")/trust-policy.json" | jq -r '.Role.RoleId')
69+
echo -e "No role found, hence creating the role. Created id: ${awsRoleID}\n"
70+
else
71+
aws iam delete-role-policy --role-name "${roleName}" --policy-name "${policyName}" 2>/dev/null || true
72+
aws iam delete-role --role-name "${roleName}"
73+
awsRoleID=$(aws iam create-role \
74+
--role-name "${roleName}" \
75+
--assume-role-policy-document "file://$(dirname "$0")/trust-policy.json" | jq -r '.Role.RoleId')
76+
echo -e "FOUND role id, deleted and recreated with new trust policy. Created id: ${awsRoleID}\n"
77+
fi
78+
echo "--------------------------------AWS Role creation ends----------------------------"
79+
80+
awsRoleArn=$(aws iam get-role --role-name "${roleName}" | jq -r '.Role.Arn')
81+
82+
echo "--------------------------------Creating S3 Bucket----------------------------"
83+
if aws s3 ls "s3://${bucketName}" 2>/dev/null; then
84+
aws s3 rb "s3://${bucketName}" --force
85+
fi
86+
aws s3 mb "s3://${bucketName}" --region "${awsRegion}"
87+
echo "Created S3 bucket: ${bucketName}"
88+
echo "--------------------------------Attaching S3 policy to IAM role----------------------------"
89+
bucketArn="arn:aws:s3:::${bucketName}"
90+
jq --arg bucketArn "$bucketArn" \
91+
--arg bucketArnWildcard "${bucketArn}/*" \
92+
'.Statement[0].Resource[0] = $bucketArn | .Statement[0].Resource[1] = $bucketArnWildcard' \
93+
"$(dirname "$0")/s3-policy-template.json" >"$(dirname "$0")/s3-policy.json"
94+
95+
aws iam put-role-policy \
96+
--role-name "${roleName}" \
97+
--policy-name "${policyName}" \
98+
--policy-document "file://$(dirname "$0")/s3-policy.json"
99+
echo "--------------------------------attach mongodb Role to AWS Role ends----------------------------"
100+
101+
# shellcheck disable=SC2086
102+
sleep 30
103+
104+
atlas cloudProviders accessRoles aws authorize "${roleID}" \
105+
--projectId "${projectId}" \
106+
--iamAssumedRoleArn "${awsRoleArn}"
107+
echo "--------------------------------authorize mongodb Role ends----------------------------"
108+
rm -rf inputs
109+
mkdir inputs
44110

45111
WORDTOREMOVE="template."
46112
cd "$(dirname "$0")" || exit
47113
for inputFile in inputs_*; do
48114
outputFile=${inputFile//$WORDTOREMOVE/}
49115
jq --arg projectId "$projectId" \
50116
--arg bucketName "$bucketName" \
51-
--arg iamRoleId "$iamRoleId" \
117+
--arg iamRoleId "$roleID" \
52118
--arg profile "$profile" \
53119
'.Profile?|=$profile | .ProjectId?|=$projectId | .BucketName?|=$bucketName | .IamRoleId?|=$iamRoleId' \
54120
"$inputFile" >"../inputs/$outputFile"

‎cfn-resources/log-integration/test/cfn-test-delete-inputs.sh‎

Lines changed: 44 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,53 @@
11
#!/usr/bin/env bash
22
# cfn-test-delete-inputs.sh
33
#
4-
# This tool deletes test input files and cleans up resources.
4+
# This tool deletes test input files and cleans up AWS resources.
55
#
66

77
set -o errexit
88
set -o nounset
99
set -o pipefail
1010

11-
rm -rf inputs
12-
echo "Deleted inputs directory"
11+
function usage {
12+
echo "usage:$0 "
13+
}
14+
15+
echo "--------------------------------delete S3 bucket and IAM role starts----------------------------"
16+
17+
projectId=$(jq -r '.ProjectId' ./inputs/inputs_1_create.json)
18+
echo "Check if a project is created $projectId"
19+
export MCLI_PROJECT_ID=$projectId
20+
21+
region=$AWS_DEFAULT_REGION
22+
if [ -z "$region" ]; then
23+
region=$(aws configure get region)
24+
fi
25+
# shellcheck disable=SC2001
26+
region=$(echo "$region" | sed -e "s/-/_/g")
27+
region=$(echo "$region" | tr '[:lower:]' '[:upper:]')
28+
29+
roleName="mongodb-atlas-logs-role-${region}"
30+
policyName="atlas-logs-s3-policy-${region}"
31+
32+
trustPolicy=$(jq '.Statement[0].Condition.StringEquals["sts:ExternalId"]' "$(dirname "$0")/trust-policy.json")
33+
# shellcheck disable=SC2001
34+
atlasAssumedRoleExternalID=$(echo "${trustPolicy}" | sed 's/"//g')
35+
36+
roleId=$(atlas cloudProviders accessRoles list --projectId "${projectId}" --output json | jq --arg roleID "${atlasAssumedRoleExternalID}" -r '.awsIamRoles[] | select(.atlasAssumedRoleExternalId | test($roleID)) | .roleId')
37+
38+
atlas cloudProviders accessRoles aws deauthorize "${roleId}" --projectId "${projectId}" --force
39+
echo "--------------------------------deauthorize role ends----------------------------"
40+
bucketName=$(jq -r '.BucketName' "./inputs/inputs_1_create.json")
41+
aws s3 rb "s3://${bucketName}" --force
42+
43+
echo "--------------------------------delete IAM role starts----------------------------"
44+
aws iam delete-role-policy --role-name "$roleName" --policy-name "$policyName"
45+
aws iam delete-role --role-name "$roleName"
46+
echo "--------------------------------delete IAM role ends----------------------------"
47+
48+
#delete project
49+
if atlas projects delete "$projectId" --force; then
50+
echo "$projectId project deletion OK"
51+
else
52+
(echo "Failed cleaning project:$projectId" && exit 1)
53+
fi

‎cfn-resources/log-integration/test/contract-testing/cfn-test-create.sh‎

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,15 +6,10 @@ set -o nounset
66
set -o pipefail
77

88
projectName="cfn-test-bot-$(date +%s)-$RANDOM"
9-
bucketName="atlas-logs-cfn-test-$RANDOM"
10-
iamRoleId="65a1b2c3d4e5f6a7b8c9d0e1"
119

12-
# create project
13-
projectId=$(atlas projects create "${projectName}" --output=json | jq -r '.id')
10+
# Set unique tag for S3 bucket to avoid conflicts in CI
11+
export CFN_TEST_TAG="${projectName}"
1412

15-
echo "projectId: $projectId"
1613
echo "projectName: $projectName"
17-
echo "bucketName: $bucketName"
18-
echo "iamRoleId: $iamRoleId (dummy 24-char hex format)"
1914

20-
./test/cfn-test-create-inputs.sh "$projectName" "$bucketName" "$iamRoleId"
15+
./test/cfn-test-create-inputs.sh "$projectName"

‎cfn-resources/log-integration/test/contract-testing/cfn-test-delete.sh‎

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,4 @@ set -o errexit
55
set -o nounset
66
set -o pipefail
77

8-
projectId=$(jq -r '.ProjectId' ./inputs/inputs_1_create.json)
9-
10-
# delete project
11-
if atlas projects delete "$projectId" --force; then
12-
echo "$projectId project deletion OK"
13-
else
14-
(echo "Failed cleaning project: $projectId" && exit 1)
15-
fi
8+
./test/cfn-test-delete-inputs.sh

‎cfn-resources/log-integration/test/role-policy-template.json‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Effect": "Allow",
6+
"Principal": {
7+
"AWS": ""
8+
},
9+
"Action": "sts:AssumeRole",
10+
"Condition": {
11+
"StringEquals": {
12+
"sts:ExternalId": ""
13+
}
14+
}
15+
}
16+
]
17+
}

‎cfn-resources/log-integration/test/s3-policy-template.json‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Effect": "Allow",
6+
"Action": [
7+
"s3:PutObject",
8+
"s3:GetObject",
9+
"s3:ListBucket",
10+
"s3:GetBucketLocation"
11+
],
12+
"Resource": ["", ""]
13+
}
14+
]
15+
}

0 commit comments

Comments
 (0)