test

Author: outcomes-winter-rakhulsprakash

cfn-resources/log-integration/test/cfn-test-create-inputs.sh

@@ -28,7 +28,8 @@ fi
 regionFormatted=$(echo "$region" | sed -e "s/-/_/g" | tr '[:lower:]' '[:upper:]')
 echo "Using region: $region (formatted: $regionFormatted)"
 
-roleName="mongodb-atlas-logs-role-${regionFormatted}"
+# Use dynamic role name to avoid conflicts in CI (matches test-folder pattern)
+roleName="mongodb-atlas-logs-role-${regionFormatted}-$(date +%s)-${RANDOM}"
 policyName="atlas-logs-s3-policy-${regionFormatted}"
 bucketTag="${CFN_TEST_TAG:-$(date +%Y%m%d%H%M%S)}"
 bucketName="mongodb-atlas-cfn-test-logs-${bucketTag}"
@@ -108,6 +109,15 @@ echo "--------------------------------authorize mongodb Role ends---------------
 rm -rf inputs
 mkdir inputs
 
+# Store AWS role ARN in a separate metadata file for cleanup (not part of CFN schema)
+cat > "$(dirname "$0")/test-metadata.json" <<EOF
+{
+  "awsRoleArn": "${awsRoleArn}",
+  "roleName": "${roleName}",
+  "policyName": "${policyName}"
+}
+EOF
+
 WORDTOREMOVE="template."
 cd "$(dirname "$0")" || exit
 for inputFile in inputs_*; do

cfn-resources/log-integration/test/cfn-test-delete-inputs.sh

@@ -18,31 +18,53 @@ projectId=$(jq -r '.ProjectId' ./inputs/inputs_1_create.json)
 echo "Check if a project is created $projectId"
 export MCLI_PROJECT_ID=$projectId
 
-region=$AWS_DEFAULT_REGION
-if [ -z "$region" ]; then
-	region=$(aws configure get region)
+# Extract role info from metadata file (not from CFN input since AwsRoleArn is not part of the schema)
+metadataFile="$(dirname "$0")/test-metadata.json"
+if [ -f "$metadataFile" ]; then
+	roleArn=$(jq -r '.awsRoleArn // empty' "$metadataFile")
+	roleName=$(jq -r '.roleName // empty' "$metadataFile")
+	policyName=$(jq -r '.policyName // empty' "$metadataFile")
+	echo "Found test metadata file with role: ${roleName}"
+else
+	echo "Warning: test-metadata.json not found, skipping IAM role cleanup"
+	roleArn=""
+	roleName=""
+	policyName=""
 fi
-# shellcheck disable=SC2001
-region=$(echo "$region" | sed -e "s/-/_/g")
-region=$(echo "$region" | tr '[:lower:]' '[:upper:]')
-
-roleName="mongodb-atlas-logs-role-${region}"
-policyName="atlas-logs-s3-policy-${region}"
 
-trustPolicy=$(jq '.Statement[0].Condition.StringEquals["sts:ExternalId"]' "$(dirname "$0")/trust-policy.json")
-# shellcheck disable=SC2001
-atlasAssumedRoleExternalID=$(echo "${trustPolicy}" | sed 's/"//g')
+# Deauthorize role from Atlas if trust policy exists
+if [ -f "$(dirname "$0")/trust-policy.json" ] && [ -n "$roleArn" ]; then
+	trustPolicy=$(jq '.Statement[0].Condition.StringEquals["sts:ExternalId"]' "$(dirname "$0")/trust-policy.json")
+	# shellcheck disable=SC2001
+	atlasAssumedRoleExternalID=$(echo "${trustPolicy}" | sed 's/"//g')
 
-roleId=$(atlas cloudProviders accessRoles list --projectId "${projectId}" --output json | jq --arg roleID "${atlasAssumedRoleExternalID}" -r '.awsIamRoles[] | select(.atlasAssumedRoleExternalId | test($roleID)) | .roleId')
+	roleId=$(atlas cloudProviders accessRoles list --projectId "${projectId}" --output json | jq --arg roleID "${atlasAssumedRoleExternalID}" -r '.awsIamRoles[] | select(.atlasAssumedRoleExternalId | test($roleID)) | .roleId')
 
-atlas cloudProviders accessRoles aws deauthorize "${roleId}" --projectId "${projectId}" --force
-echo "--------------------------------deauthorize role ends----------------------------"
+	if [ -n "${roleId}" ] && [ "${roleId}" != "null" ]; then
+		echo "Deauthorizing role from Atlas: ${roleId}"
+		atlas cloudProviders accessRoles aws deauthorize "${roleId}" --projectId "${projectId}" --force
+		echo "--------------------------------deauthorize role ends----------------------------"
+	else
+		echo "Warning: Could not find Atlas role ID to deauthorize"
+	fi
+else
+	if [ -z "$roleArn" ]; then
+		echo "Warning: No role ARN found in metadata, skipping Atlas role deauthorization"
+	else
+		echo "Warning: trust-policy.json not found, skipping Atlas role deauthorization"
+	fi
+fi
 bucketName=$(jq -r '.BucketName' "./inputs/inputs_1_create.json")
 aws s3 rb "s3://${bucketName}" --force
 
 echo "--------------------------------delete IAM role starts----------------------------"
-aws iam delete-role-policy --role-name "$roleName" --policy-name "$policyName"
-aws iam delete-role --role-name "$roleName"
+if [ -n "$roleName" ]; then
+	aws iam delete-role-policy --role-name "$roleName" --policy-name "$policyName" || echo "Failed to delete role policy (may not exist)"
+	aws iam delete-role --role-name "$roleName" || echo "Failed to delete role (may not exist)"
+	echo "Deleted IAM role: ${roleName}"
+else
+	echo "No IAM role to delete (not found in inputs)"
+fi
 echo "--------------------------------delete IAM role ends----------------------------"
 
 #delete project