Repository navigation
fix(idle-shutdown): give DescribeInstanceStatus Resource * in wake policy #138
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,96 @@ | ||
| #!/usr/bin/env bash | ||
| # tests/test-idle-wake-policy.sh — Contract test for the wake Lambda IAM policy | ||
| # in bootstraps/optional/idle-shutdown/install-idle.sh. | ||
| # | ||
| # EC2 Describe* actions do not support resource-level permissions. They match | ||
| # only "Resource": "*". This test reads the WAKE_INLINE policy from the script | ||
| # and makes sure that: | ||
| # - the policy is valid JSON after variable substitution | ||
| # - each statement with an ec2:Describe* action has "Resource": "*" | ||
| # - ec2:StartInstances stays limited to the one instance ARN | ||
| # | ||
| # No AWS required. Run standalone or via CI (discovered by pack-tests.yml). | ||
| set -euo pipefail | ||
|
|
||
| SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" | ||
| REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)" | ||
| INSTALL="$REPO_ROOT/bootstraps/optional/idle-shutdown/install-idle.sh" | ||
|
|
||
| if [[ ! -f "$INSTALL" ]]; then | ||
| echo "FAIL: install-idle.sh not found at $INSTALL" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| RED='\033[0;31m'; GREEN='\033[0;32m'; BOLD='\033[1m'; NC='\033[0m' | ||
| PASS=0; FAIL=0 | ||
|
|
||
| pass() { printf "${GREEN} \xE2\x9C\x93${NC} %s\n" "$1"; PASS=$((PASS + 1)); } | ||
| fail() { printf "${RED} \xE2\x9C\x97${NC} %s\n" "$1"; FAIL=$((FAIL + 1)); } | ||
|
|
||
| printf "${BOLD}idle-shutdown wake Lambda IAM policy${NC}\n" | ||
|
|
||
| # Get the heredoc body between 'WAKE_INLINE=$(cat <<JSON' and the closing 'JSON'. | ||
| POLICY="$(awk '/^WAKE_INLINE=\$\(cat <<JSON$/{f=1; next} f && /^JSON$/{exit} f' "$INSTALL")" | ||
|
|
||
| if [[ -z "$POLICY" ]]; then | ||
| fail "WAKE_INLINE heredoc found in install-idle.sh" | ||
| printf "\n%d passed, %d failed\n" "$PASS" "$FAIL" | ||
| exit 1 | ||
| fi | ||
| pass "WAKE_INLINE heredoc found in install-idle.sh" | ||
|
|
||
| # Check the policy with Python. Each output line is "PASS <msg>" or "FAIL <msg>". | ||
| RESULTS="$(POLICY="$POLICY" python3 - <<'PY' | ||
| import json, os | ||
|
|
||
| region, acct, inst = "us-east-1", "123456789012", "i-0123456789abcdef0" | ||
| text = (os.environ["POLICY"] | ||
| .replace("${REGION}", region) | ||
| .replace("${ACCT_ID}", acct) | ||
| .replace("${INSTANCE_ID}", inst)) | ||
| instance_arn = f"arn:aws:ec2:{region}:{acct}:instance/{inst}" | ||
|
|
||
| def out(ok, msg): | ||
| print(("PASS " if ok else "FAIL ") + msg) | ||
|
|
||
| try: | ||
| doc = json.loads(text) | ||
| except ValueError as e: | ||
| out(False, f"policy is valid JSON ({e})") | ||
| raise SystemExit(0) | ||
| out(True, "policy is valid JSON") | ||
|
|
||
| def as_list(v): | ||
| return v if isinstance(v, list) else [v] | ||
|
|
||
| stmts = as_list(doc.get("Statement", [])) | ||
| describe_seen = False | ||
| start_seen = False | ||
| for s in stmts: | ||
| actions = as_list(s.get("Action", [])) | ||
| resources = as_list(s.get("Resource", [])) | ||
| describes = [a for a in actions if a.startswith("ec2:Describe")] | ||
| if describes: | ||
| describe_seen = True | ||
| out(resources == ["*"], | ||
| f"{', '.join(describes)} uses Resource \"*\" (got {resources})") | ||
| if "ec2:StartInstances" in actions: | ||
| start_seen = True | ||
| out(resources == [instance_arn], | ||
| f"ec2:StartInstances is limited to the instance ARN (got {resources})") | ||
|
|
||
| out(describe_seen, "policy allows ec2:DescribeInstanceStatus") | ||
|
There was a problem hiding this comment.
This assertion labels any Useful? React with 👍 / 👎.
Member
Author
There was a problem hiding this comment. Fixed in d767a4b. The test now sets the "allows ec2:DescribeInstanceStatus" result only when that exact action is in a statement. I checked it with a mutation: when I change the action to |
||
| out(start_seen, "policy allows ec2:StartInstances") | ||
| PY | ||
| )" | ||
|
|
||
| while IFS= read -r line; do | ||
| [[ -z "$line" ]] && continue | ||
| case "$line" in | ||
| PASS\ *) pass "${line#PASS }" ;; | ||
| *) fail "${line#FAIL }" ;; | ||
| esac | ||
| done <<< "$RESULTS" | ||
|
|
||
| printf "\n%d passed, %d failed\n" "$PASS" "$FAIL" | ||
| [[ "$FAIL" -eq 0 ]] | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Although the new test is discovered when the workflow runs,
.github/workflows/pack-tests.ymllines 6-20 do not includebootstraps/**in either path filter. A future PR that changes onlybootstraps/optional/idle-shutdown/install-idle.shtherefore will not start this workflow, so the contract test cannot catch the policy regression it was added to prevent; add the relevant bootstrap path to both workflow filters.Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Correct:
pack-tests.ymldoes not havebootstraps/**in its path filters, so a change toinstall-idle.shalone does not start this test. I did not change the workflow, because changes to CI configuration are a maintainer decision and not part of a fix for #129. In d767a4b I added a note to the test header about this. Recommendation for a maintainer: addbootstraps/**to both thepushandpull_requestpath filters ofpack-tests.yml(tests/test-idle-check.sh has the same gap foridle-check.py).