Skip to content

Commit dce6142

Browse files
outcomes-winter-rakhulsprakashoutcomes-winter-rakhulsprakash
committed
test
1 parent 1df1eb8 commit dce6142

3 files changed

Lines changed: 76 additions & 20 deletions

File tree

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,3 +53,4 @@ cfn-resources/resource-versions.md
5353
**/test/trust-policy.json
5454
**/test/s3-policy.json
5555
**/test/add-policy.json
56+
**/test/test-metadata.json

‎cfn-resources/log-integration/test/cfn-test-create-inputs.sh‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,8 @@ fi
2828
regionFormatted=$(echo "$region" | sed -e "s/-/_/g" | tr '[:lower:]' '[:upper:]')
2929
echo "Using region: $region (formatted: $regionFormatted)"
3030

31-
roleName="mongodb-atlas-logs-role-${regionFormatted}"
31+
# Use dynamic role name to avoid conflicts in CI (matches test-folder pattern)
32+
roleName="mongodb-atlas-logs-role-${regionFormatted}-$(date +%s)-${RANDOM}"
3233
policyName="atlas-logs-s3-policy-${regionFormatted}"
3334
bucketTag="${CFN_TEST_TAG:-$(date +%Y%m%d%H%M%S)}"
3435
bucketName="mongodb-atlas-cfn-test-logs-${bucketTag}"
@@ -108,6 +109,15 @@ echo "--------------------------------authorize mongodb Role ends---------------
108109
rm -rf inputs
109110
mkdir inputs
110111

112+
# Store AWS role ARN in a separate metadata file for cleanup (not part of CFN schema)
113+
cat > "$(dirname "$0")/test-metadata.json" <<EOF
114+
{
115+
"awsRoleArn": "${awsRoleArn}",
116+
"roleName": "${roleName}",
117+
"policyName": "${policyName}"
118+
}
119+
EOF
120+
111121
WORDTOREMOVE="template."
112122
cd "$(dirname "$0")" || exit
113123
for inputFile in inputs_*; do

‎cfn-resources/log-integration/test/cfn-test-delete-inputs.sh‎

Lines changed: 64 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -18,36 +18,81 @@ projectId=$(jq -r '.ProjectId' ./inputs/inputs_1_create.json)
1818
echo "Check if a project is created $projectId"
1919
export MCLI_PROJECT_ID=$projectId
2020

21-
region=$AWS_DEFAULT_REGION
22-
if [ -z "$region" ]; then
23-
region=$(aws configure get region)
21+
# Extract role info from metadata file (not from CFN input since AwsRoleArn is not part of the schema)
22+
metadataFile="$(dirname "$0")/test-metadata.json"
23+
if [ -f "$metadataFile" ]; then
24+
roleArn=$(jq -r '.awsRoleArn // empty' "$metadataFile")
25+
roleName=$(jq -r '.roleName // empty' "$metadataFile")
26+
policyName=$(jq -r '.policyName // empty' "$metadataFile")
27+
echo "Found test metadata file with role: ${roleName}"
28+
else
29+
echo "Warning: test-metadata.json not found, skipping IAM role cleanup"
30+
roleArn=""
31+
roleName=""
32+
policyName=""
2433
fi
25-
# shellcheck disable=SC2001
26-
region=$(echo "$region" | sed -e "s/-/_/g")
27-
region=$(echo "$region" | tr '[:lower:]' '[:upper:]')
28-
29-
roleName="mongodb-atlas-logs-role-${region}"
30-
policyName="atlas-logs-s3-policy-${region}"
3134

32-
trustPolicy=$(jq '.Statement[0].Condition.StringEquals["sts:ExternalId"]' "$(dirname "$0")/trust-policy.json")
33-
# shellcheck disable=SC2001
34-
atlasAssumedRoleExternalID=$(echo "${trustPolicy}" | sed 's/"//g')
35+
# Deauthorize role from Atlas if trust policy exists
36+
if [ -f "$(dirname "$0")/trust-policy.json" ] && [ -n "$roleArn" ]; then
37+
trustPolicy=$(jq '.Statement[0].Condition.StringEquals["sts:ExternalId"]' "$(dirname "$0")/trust-policy.json")
38+
# shellcheck disable=SC2001
39+
atlasAssumedRoleExternalID=$(echo "${trustPolicy}" | sed 's/"//g')
3540

36-
roleId=$(atlas cloudProviders accessRoles list --projectId "${projectId}" --output json | jq --arg roleID "${atlasAssumedRoleExternalID}" -r '.awsIamRoles[] | select(.atlasAssumedRoleExternalId | test($roleID)) | .roleId')
41+
# Try to get roleId from Atlas (non-fatal if it fails)
42+
if atlas cloudProviders accessRoles list --projectId "${projectId}" --output json > /tmp/atlas_roles.json 2>&1; then
43+
roleId=$(jq --arg roleID "${atlasAssumedRoleExternalID}" -r '.awsIamRoles[] | select(.atlasAssumedRoleExternalId | test($roleID)) | .roleId' /tmp/atlas_roles.json 2>/dev/null || echo "")
44+
rm -f /tmp/atlas_roles.json
3745

38-
atlas cloudProviders accessRoles aws deauthorize "${roleId}" --projectId "${projectId}" --force
39-
echo "--------------------------------deauthorize role ends----------------------------"
46+
if [ -n "${roleId}" ] && [ "${roleId}" != "null" ] && [ "${roleId}" != "" ]; then
47+
echo "Deauthorizing role from Atlas: ${roleId}"
48+
if atlas cloudProviders accessRoles aws deauthorize "${roleId}" --projectId "${projectId}" --force; then
49+
echo "Successfully deauthorized role"
50+
else
51+
echo "Failed to deauthorize role (may already be deauthorized)"
52+
fi
53+
echo "--------------------------------deauthorize role ends----------------------------"
54+
else
55+
echo "Warning: Could not find Atlas role ID to deauthorize (may already be deauthorized)"
56+
fi
57+
else
58+
echo "Warning: Could not list Atlas roles (may be authentication issue or project already deleted)"
59+
rm -f /tmp/atlas_roles.json
60+
fi
61+
else
62+
if [ -z "$roleArn" ]; then
63+
echo "Warning: No role ARN found in metadata, skipping Atlas role deauthorization"
64+
else
65+
echo "Warning: trust-policy.json not found, skipping Atlas role deauthorization"
66+
fi
67+
fi
4068
bucketName=$(jq -r '.BucketName' "./inputs/inputs_1_create.json")
41-
aws s3 rb "s3://${bucketName}" --force
69+
if [ -n "$bucketName" ] && [ "$bucketName" != "null" ]; then
70+
echo "Deleting S3 bucket: ${bucketName}"
71+
aws s3 rb "s3://${bucketName}" --force || echo "Failed to delete S3 bucket (may already be deleted)"
72+
else
73+
echo "Warning: No bucket name found in inputs"
74+
fi
4275

4376
echo "--------------------------------delete IAM role starts----------------------------"
44-
aws iam delete-role-policy --role-name "$roleName" --policy-name "$policyName"
45-
aws iam delete-role --role-name "$roleName"
77+
if [ -n "$roleName" ]; then
78+
echo "Deleting IAM role: ${roleName}"
79+
aws iam delete-role-policy --role-name "$roleName" --policy-name "$policyName" 2>/dev/null || echo "Role policy already deleted or doesn't exist"
80+
aws iam delete-role --role-name "$roleName" 2>/dev/null || echo "Role already deleted or doesn't exist"
81+
echo "Deleted IAM role: ${roleName}"
82+
else
83+
echo "No IAM role to delete (not found in metadata)"
84+
fi
4685
echo "--------------------------------delete IAM role ends----------------------------"
4786

87+
# Clean up temporary test files
88+
rm -f "$(dirname "$0")/trust-policy.json"
89+
rm -f "$(dirname "$0")/s3-policy.json"
90+
rm -f "$(dirname "$0")/test-metadata.json"
91+
echo "Cleaned up temporary test files"
92+
4893
#delete project
4994
if atlas projects delete "$projectId" --force; then
5095
echo "$projectId project deletion OK"
5196
else
52-
(echo "Failed cleaning project:$projectId" && exit 1)
97+
echo "Warning: Failed cleaning project:$projectId (may be authentication issue or already deleted)"
5398
fi

0 commit comments

Comments
 (0)