fixed the tests

moj-analytical-services · Dec 3, 2024 · c160d16 · c160d16
1 parent ce9d653
commit c160d16
Show file tree

Hide file tree

Showing 8 changed files with 22 additions and 12 deletions.
diff --git a/README.md b/README.md
@@ -57,7 +57,7 @@ secrets: true
 
 secretsmanager: 
   read_only:
-    - test_secret_name
+    - test_secret
 
 s3:
   read_only:

diff --git a/iam_builder/schemas/iam_schema.json b/iam_builder/schemas/iam_schema.json
@@ -96,6 +96,7 @@
                         "type": "string"
                     }
                 }
+            }
         },
         "bedrock": {
             "description": "bedrock must be set to true to allow role to interact with Amazon Bedrock.",

diff --git a/iam_builder/templates.py b/iam_builder/templates.py
@@ -449,7 +449,12 @@ def get_kms_permissions(kms_arns: list) -> dict:
     }
     return policy
 
-def get_secretsmanager_read_only_policy(secret_name: str) -> str:
+def get_secretsmanager_read_only_policy(secret_name: list) -> dict:
+    # prepare segments that depend on dump bucket name
+    allow_list_of_secrets = []
+    allow_list_of_secrets.extend([
+        "arn:aws:secretsmanager:*:*:secret:" + secret + "*" for secret in secret_name
+        ])
     policy = {
         "Sid": "readSecrets",
         "Action": [
@@ -458,6 +463,6 @@ def get_secretsmanager_read_only_policy(secret_name: str) -> str:
             "secretsmanager:ListSecrets",
         ],
         "Effect": "Allow",
-        "Resource": f"arn:aws:secretsmanager:*:*:secret:{secret_name}*",
+        "Resource": allow_list_of_secrets
     }
     return policy
diff --git a/tests/expected_policy/secretsmanager_read_only.json b/tests/expected_policy/secretsmanager_read_only.json
@@ -2,16 +2,14 @@
     "Version": "2012-10-17",
     "Statement": [
         {
-            "Sid": "readSecretsmanager",
-            "Effect": "Allow",
+            "Sid": "readSecrets",
             "Action": [
                 "secretsmanager:GetSecretValue",
                 "secretsmanager:DescribeSecret",
                 "secretsmanager:ListSecrets"
             ],
-            "Resource": [
-                "arn:aws:secretsmanager:*:*:secret:test_secret"
-            ]
+            "Effect": "Allow",
+            "Resource": ["arn:aws:secretsmanager:*:*:secret:test_secret*"]
         }
     ]
 }
diff --git a/tests/test_config/bad_secretsmanager_read_write.yaml b/tests/test_config/bad_secretsmanager_read_write.yaml
@@ -1,3 +1,5 @@
 iam_role_name: an_iam_role_name
 
-secretsmanager: read_write
+secretsmanager:
+  read_write: 
+    - test_secret
diff --git a/tests/test_config/bad_secretsmanager_write_only.yaml b/tests/test_config/bad_secretsmanager_write_only.yaml
@@ -1,3 +1,5 @@
 iam_role_name: an_iam_role_name
 
-secretsmanager: write_only
+secretsmanager:
+  write_only: 
+    - test_secret
diff --git a/tests/test_config/secretsmanager_read_only.yaml b/tests/test_config/secretsmanager_read_only.yaml
@@ -1,5 +1,5 @@
 iam_role_name: an_iam_role_name
 
 secretsmanager:
-  read_only:
-    - test/test_secret
+  read_only: 
+    - test_secret
diff --git a/tests/test_iam_builder.py b/tests/test_iam_builder.py
@@ -25,6 +25,8 @@ def assert_config_as_expected(ut, config_name):
         expected = json.load(f)
 
     out = build_iam_policy(config)
+    print(expected)
+    print(out)
     ut.assertDictEqual(out, expected)
-Original file line number
+Diff line change
@@ Expand Up / @@ -96,6 +96,7 @@ @@
                             "type": "string"
                         }
                     }
+                }
             },
             "bedrock": {
                 "description": "bedrock must be set to true to allow role to interact with Amazon Bedrock.",
@@ Expand Down @@