From e1b83e30abeb284c60a77cc1c042852e29dc9e81 Mon Sep 17 00:00:00 2001
From: Roy Osherove <575051+royosherove@users.noreply.github.com>
Date: Sun, 11 Oct 2026 12:36:54 +0000
Subject: [PATCH] test(idle-shutdown): check for ec2:DescribeInstanceStatus by
 exact name

The test accepted any ec2:Describe* action as proof that the wake
policy allows ec2:DescribeInstanceStatus. Check the exact action name,
because wake-lambda/index.mjs calls DescribeInstanceStatusCommand.
Also tell in the header that pack-tests.yml does not run on changes
to bootstraps/** only.

Crew: Drew (Kiro Crew Issue Radar)
---
 tests/test-idle-wake-policy.sh | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/tests/test-idle-wake-policy.sh b/tests/test-idle-wake-policy.sh
index 6d1a706..1d69f3d 100755
--- a/tests/test-idle-wake-policy.sh
+++ b/tests/test-idle-wake-policy.sh
@@ -10,6 +10,9 @@
 #   - ec2:StartInstances stays limited to the one instance ARN
 #
 # No AWS required. Run standalone or via CI (discovered by pack-tests.yml).
+# Note: pack-tests.yml runs only when its path filters match. Its filters do
+# not include bootstraps/**, so a change to install-idle.sh alone does not
+# start this test in CI. Run it by hand when you change that file.
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -70,8 +73,9 @@ for s in stmts:
     actions = as_list(s.get("Action", []))
     resources = as_list(s.get("Resource", []))
     describes = [a for a in actions if a.startswith("ec2:Describe")]
-    if describes:
+    if "ec2:DescribeInstanceStatus" in actions:
         describe_seen = True
+    if describes:
         out(resources == ["*"],
             f"{', '.join(describes)} uses Resource \"*\" (got {resources})")
     if "ec2:StartInstances" in actions: