github.com/minamijoyo/terraform@v0.7.8-0.20161029001309-18b3736ba44b/builtin/providers/aws/resource_aws_iam_user_login_profile_test.go (about) 1 package aws 2 3 import ( 4 "errors" 5 "fmt" 6 "testing" 7 "time" 8 9 "github.com/aws/aws-sdk-go/aws" 10 "github.com/aws/aws-sdk-go/aws/awserr" 11 "github.com/aws/aws-sdk-go/aws/credentials" 12 "github.com/aws/aws-sdk-go/aws/session" 13 "github.com/aws/aws-sdk-go/service/iam" 14 "github.com/hashicorp/terraform/helper/acctest" 15 "github.com/hashicorp/terraform/helper/resource" 16 "github.com/hashicorp/terraform/terraform" 17 "github.com/hashicorp/vault/helper/pgpkeys" 18 "regexp" 19 ) 20 21 func TestAccAWSUserLoginProfile_basic(t *testing.T) { 22 var conf iam.GetLoginProfileOutput 23 24 username := fmt.Sprintf("test-user-%d", acctest.RandInt()) 25 26 resource.Test(t, resource.TestCase{ 27 PreCheck: func() { testAccPreCheck(t) }, 28 Providers: testAccProviders, 29 CheckDestroy: testAccCheckAWSUserLoginProfileDestroy, 30 Steps: []resource.TestStep{ 31 { 32 Config: testAccAWSUserLoginProfileConfig(username, "/", testPubKey1), 33 Check: resource.ComposeTestCheckFunc( 34 testAccCheckAWSUserLoginProfileExists("aws_iam_user_login_profile.user", &conf), 35 testDecryptPasswordAndTest("aws_iam_user_login_profile.user", "aws_iam_access_key.user", testPrivKey1), 36 ), 37 }, 38 }, 39 }) 40 } 41 42 func TestAccAWSUserLoginProfile_keybase(t *testing.T) { 43 var conf iam.GetLoginProfileOutput 44 45 username := fmt.Sprintf("test-user-%d", acctest.RandInt()) 46 47 resource.Test(t, resource.TestCase{ 48 PreCheck: func() { testAccPreCheck(t) }, 49 Providers: testAccProviders, 50 CheckDestroy: testAccCheckAWSUserLoginProfileDestroy, 51 Steps: []resource.TestStep{ 52 { 53 Config: testAccAWSUserLoginProfileConfig(username, "/", "keybase:terraformacctest"), 54 Check: resource.ComposeTestCheckFunc( 55 testAccCheckAWSUserLoginProfileExists("aws_iam_user_login_profile.user", &conf), 56 resource.TestCheckResourceAttrSet("aws_iam_user_login_profile.user", "encrypted_password"), 57 resource.TestCheckResourceAttrSet("aws_iam_user_login_profile.user", "key_fingerprint"), 58 ), 59 }, 60 }, 61 }) 62 } 63 64 func TestAccAWSUserLoginProfile_keybaseDoesntExist(t *testing.T) { 65 username := fmt.Sprintf("test-user-%d", acctest.RandInt()) 66 67 resource.Test(t, resource.TestCase{ 68 PreCheck: func() { testAccPreCheck(t) }, 69 Providers: testAccProviders, 70 CheckDestroy: testAccCheckAWSUserLoginProfileDestroy, 71 Steps: []resource.TestStep{ 72 { 73 // We own this account but it doesn't have any key associated with it 74 Config: testAccAWSUserLoginProfileConfig(username, "/", "keybase:terraform_nope"), 75 ExpectError: regexp.MustCompile(`Error retrieving Public Key`), 76 }, 77 }, 78 }) 79 } 80 81 func TestAccAWSUserLoginProfile_notAKey(t *testing.T) { 82 username := fmt.Sprintf("test-user-%d", acctest.RandInt()) 83 84 resource.Test(t, resource.TestCase{ 85 PreCheck: func() { testAccPreCheck(t) }, 86 Providers: testAccProviders, 87 CheckDestroy: testAccCheckAWSUserLoginProfileDestroy, 88 Steps: []resource.TestStep{ 89 { 90 // We own this account but it doesn't have any key associated with it 91 Config: testAccAWSUserLoginProfileConfig(username, "/", "lolimnotakey"), 92 ExpectError: regexp.MustCompile(`Error encrypting password`), 93 }, 94 }, 95 }) 96 } 97 98 func testAccCheckAWSUserLoginProfileDestroy(s *terraform.State) error { 99 iamconn := testAccProvider.Meta().(*AWSClient).iamconn 100 101 for _, rs := range s.RootModule().Resources { 102 if rs.Type != "aws_iam_user_login_profile" { 103 continue 104 } 105 106 // Try to get user 107 _, err := iamconn.GetLoginProfile(&iam.GetLoginProfileInput{ 108 UserName: aws.String(rs.Primary.ID), 109 }) 110 if err == nil { 111 return fmt.Errorf("still exists.") 112 } 113 114 // Verify the error is what we want 115 ec2err, ok := err.(awserr.Error) 116 if !ok { 117 return err 118 } 119 if ec2err.Code() != "NoSuchEntity" { 120 return err 121 } 122 } 123 124 return nil 125 } 126 127 func testDecryptPasswordAndTest(nProfile, nAccessKey, key string) resource.TestCheckFunc { 128 return func(s *terraform.State) error { 129 profileResource, ok := s.RootModule().Resources[nProfile] 130 if !ok { 131 return fmt.Errorf("Not found: %s", nProfile) 132 } 133 134 password, ok := profileResource.Primary.Attributes["encrypted_password"] 135 if !ok { 136 return errors.New("No password in state") 137 } 138 139 accessKeyResource, ok := s.RootModule().Resources[nAccessKey] 140 if !ok { 141 return fmt.Errorf("Not found: %s", nAccessKey) 142 } 143 144 accessKeyId := accessKeyResource.Primary.ID 145 secretAccessKey, ok := accessKeyResource.Primary.Attributes["secret"] 146 if !ok { 147 return errors.New("No secret access key in state") 148 } 149 150 decryptedPassword, err := pgpkeys.DecryptBytes(password, key) 151 if err != nil { 152 return fmt.Errorf("Error decrypting password: %s", err) 153 } 154 155 iamAsCreatedUserSession := session.New(&aws.Config{ 156 Region: aws.String("us-west-2"), 157 Credentials: credentials.NewStaticCredentials(accessKeyId, secretAccessKey, ""), 158 }) 159 _, err = iamAsCreatedUserSession.Config.Credentials.Get() 160 if err != nil { 161 return fmt.Errorf("Error getting session credentials: %s", err) 162 } 163 164 return resource.Retry(2*time.Minute, func() *resource.RetryError { 165 iamAsCreatedUser := iam.New(iamAsCreatedUserSession) 166 _, err = iamAsCreatedUser.ChangePassword(&iam.ChangePasswordInput{ 167 OldPassword: aws.String(decryptedPassword.String()), 168 NewPassword: aws.String(generatePassword(20)), 169 }) 170 if err != nil { 171 if awserr, ok := err.(awserr.Error); ok && awserr.Code() == "InvalidClientTokenId" { 172 return resource.RetryableError(err) 173 } 174 175 return resource.NonRetryableError(fmt.Errorf("Error changing decrypted password: %s", err)) 176 } 177 178 return nil 179 }) 180 } 181 } 182 183 func testAccCheckAWSUserLoginProfileExists(n string, res *iam.GetLoginProfileOutput) resource.TestCheckFunc { 184 return func(s *terraform.State) error { 185 rs, ok := s.RootModule().Resources[n] 186 if !ok { 187 return fmt.Errorf("Not found: %s", n) 188 } 189 190 if rs.Primary.ID == "" { 191 return errors.New("No UserName is set") 192 } 193 194 iamconn := testAccProvider.Meta().(*AWSClient).iamconn 195 resp, err := iamconn.GetLoginProfile(&iam.GetLoginProfileInput{ 196 UserName: aws.String(rs.Primary.ID), 197 }) 198 if err != nil { 199 return err 200 } 201 202 *res = *resp 203 204 return nil 205 } 206 } 207 208 func testAccAWSUserLoginProfileConfig(r, p, key string) string { 209 return fmt.Sprintf(` 210 resource "aws_iam_user" "user" { 211 name = "%s" 212 path = "%s" 213 force_destroy = true 214 } 215 216 data "aws_caller_identity" "current" {} 217 218 data "aws_iam_policy_document" "user" { 219 statement { 220 effect = "Allow" 221 actions = ["iam:GetAccountPasswordPolicy"] 222 resources = ["*"] 223 } 224 statement { 225 effect = "Allow" 226 actions = ["iam:ChangePassword"] 227 resources = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:user/&{aws:username}"] 228 } 229 } 230 231 resource "aws_iam_user_policy" "user" { 232 name = "AllowChangeOwnPassword" 233 user = "${aws_iam_user.user.name}" 234 policy = "${data.aws_iam_policy_document.user.json}" 235 } 236 237 resource "aws_iam_access_key" "user" { 238 user = "${aws_iam_user.user.name}" 239 } 240 241 resource "aws_iam_user_login_profile" "user" { 242 user = "${aws_iam_user.user.name}" 243 pgp_key = "%s" 244 } 245 `, r, p, key) 246 } 247 248 const testPubKey1 = `mQENBFXbjPUBCADjNjCUQwfxKL+RR2GA6pv/1K+zJZ8UWIF9S0lk7cVIEfJiprzzwiMwBS5cD0da 249 rGin1FHvIWOZxujA7oW0O2TUuatqI3aAYDTfRYurh6iKLC+VS+F7H+/mhfFvKmgr0Y5kDCF1j0T/ 250 063QZ84IRGucR/X43IY7kAtmxGXH0dYOCzOe5UBX1fTn3mXGe2ImCDWBH7gOViynXmb6XNvXkP0f 251 sF5St9jhO7mbZU9EFkv9O3t3EaURfHopsCVDOlCkFCw5ArY+DUORHRzoMX0PnkyQb5OzibkChzpg 252 8hQssKeVGpuskTdz5Q7PtdW71jXd4fFVzoNH8fYwRpziD2xNvi6HABEBAAG0EFZhdWx0IFRlc3Qg 253 S2V5IDGJATgEEwECACIFAlXbjPUCGy8GCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEOfLr44B 254 HbeTo+sH/i7bapIgPnZsJ81hmxPj4W12uvunksGJiC7d4hIHsG7kmJRTJfjECi+AuTGeDwBy84TD 255 cRaOB6e79fj65Fg6HgSahDUtKJbGxj/lWzmaBuTzlN3CEe8cMwIPqPT2kajJVdOyrvkyuFOdPFOE 256 A7bdCH0MqgIdM2SdF8t40k/ATfuD2K1ZmumJ508I3gF39jgTnPzD4C8quswrMQ3bzfvKC3klXRlB 257 C0yoArn+0QA3cf2B9T4zJ2qnvgotVbeK/b1OJRNj6Poeo+SsWNc/A5mw7lGScnDgL3yfwCm1gQXa 258 QKfOt5x+7GqhWDw10q+bJpJlI10FfzAnhMF9etSqSeURBRW5AQ0EVduM9QEIAL53hJ5bZJ7oEDCn 259 aY+SCzt9QsAfnFTAnZJQrvkvusJzrTQ088eUQmAjvxkfRqnv981fFwGnh2+I1Ktm698UAZS9Jt8y 260 jak9wWUICKQO5QUt5k8cHwldQXNXVXFa+TpQWQR5yW1a9okjh5o/3d4cBt1yZPUJJyLKY43Wvptb 261 6EuEsScO2DnRkh5wSMDQ7dTooddJCmaq3LTjOleRFQbu9ij386Do6jzK69mJU56TfdcydkxkWF5N 262 ZLGnED3lq+hQNbe+8UI5tD2oP/3r5tXKgMy1R/XPvR/zbfwvx4FAKFOP01awLq4P3d/2xOkMu4Lu 263 9p315E87DOleYwxk+FoTqXEAEQEAAYkCPgQYAQIACQUCVduM9QIbLgEpCRDny6+OAR23k8BdIAQZ 264 AQIABgUCVduM9QAKCRAID0JGyHtSGmqYB/4m4rJbbWa7dBJ8VqRU7ZKnNRDR9CVhEGipBmpDGRYu 265 lEimOPzLUX/ZXZmTZzgemeXLBaJJlWnopVUWuAsyjQuZAfdd8nHkGRHG0/DGum0l4sKTta3OPGHN 266 C1z1dAcQ1RCr9bTD3PxjLBczdGqhzw71trkQRBRdtPiUchltPMIyjUHqVJ0xmg0hPqFic0fICsr0 267 YwKoz3h9+QEcZHvsjSZjgydKvfLYcm+4DDMCCqcHuJrbXJKUWmJcXR0y/+HQONGrGJ5xWdO+6eJi 268 oPn2jVMnXCm4EKc7fcLFrz/LKmJ8seXhxjM3EdFtylBGCrx3xdK0f+JDNQaC/rhUb5V2XuX6VwoH 269 /AtY+XsKVYRfNIupLOUcf/srsm3IXT4SXWVomOc9hjGQiJ3rraIbADsc+6bCAr4XNZS7moViAAcI 270 PXFv3m3WfUlnG/om78UjQqyVACRZqqAGmuPq+TSkRUCpt9h+A39LQWkojHqyob3cyLgy6z9Q557O 271 9uK3lQozbw2gH9zC0RqnePl+rsWIUU/ga16fH6pWc1uJiEBt8UZGypQ/E56/343epmYAe0a87sHx 272 8iDV+dNtDVKfPRENiLOOc19MmS+phmUyrbHqI91c0pmysYcJZCD3a502X1gpjFbPZcRtiTmGnUKd 273 OIu60YPNE4+h7u2CfYyFPu3AlUaGNMBlvy6PEpU=` 274 275 const testPrivKey1 = `lQOYBFXbjPUBCADjNjCUQwfxKL+RR2GA6pv/1K+zJZ8UWIF9S0lk7cVIEfJiprzzwiMwBS5cD0da 276 rGin1FHvIWOZxujA7oW0O2TUuatqI3aAYDTfRYurh6iKLC+VS+F7H+/mhfFvKmgr0Y5kDCF1j0T/ 277 063QZ84IRGucR/X43IY7kAtmxGXH0dYOCzOe5UBX1fTn3mXGe2ImCDWBH7gOViynXmb6XNvXkP0f 278 sF5St9jhO7mbZU9EFkv9O3t3EaURfHopsCVDOlCkFCw5ArY+DUORHRzoMX0PnkyQb5OzibkChzpg 279 8hQssKeVGpuskTdz5Q7PtdW71jXd4fFVzoNH8fYwRpziD2xNvi6HABEBAAEAB/wL+KX0mdeISEpX 280 oDgt766Key1Kthe8nbEs5dOXIsP7OR7ZPcnE2hy6gftgVFnBGEZnWVN70vmJd6Z5y9d1mI+GecXj 281 UL0EpI0EmohyYDJsHUnght/5ecRNFA+VeNmGPYNQGCeHJyZOiFunGGENpHU7BbubAht8delz37Mx 282 JQgvMyR6AKvg8HKBoQeqV1uMWNJE/vKwV/z1dh1sjK/GFxu05Qaq0GTfAjVLuFOyJTS95yq6gblD 283 jUdbHLp7tBeqIKo9voWCJF5mGOlq3973vVoWETy9b0YYPCE/M7fXmK9dJITHqkROLMW6TgcFeIw4 284 yL5KOBCHk+QGPSvyQN7R7Fd5BADwuT1HZmvg7Y9GjarKXDjxdNemUiHtba2rUzfH6uNmKNQvwQek 285 nma5palNUJ4/dz1aPB21FUBXJF5yWwXEdApl+lIDU0J5m4UD26rqEVRq9Kx3GsX+yfcwObkrSzW6 286 kmnQSB5KI0fIuegMTM+Jxo3pB/mIRwDTMmk+vfzIGyW+7QQA8aFwFLMdKdfLgSGbl5Z6etmOAVQ2 287 Oe2ebegU9z/ewi/Rdt2s9yQiAdGVM8+q15Saz8a+kyS/l1CjNPzr3VpYx1OdZ3gb7i2xoy9GdMYR 288 ZpTq3TuST95kx/9DqA97JrP23G47U0vwF/cg8ixCYF8Fz5dG4DEsxgMwKqhGdW58wMMD/iytkfMk 289 Vk6Z958Rpy7lhlC6L3zpO38767bSeZ8gRRi/NMFVOSGYepKFarnfxcTiNa+EoSVA6hUo1N64nALE 290 sJBpyOoTfKIpz7WwTF1+WogkiYrfM6lHon1+3qlziAcRW0IohM3g2C1i3GWdON4Cl8/PDO3R0E52 291 N6iG/ctNNeMiPe60EFZhdWx0IFRlc3QgS2V5IDGJATgEEwECACIFAlXbjPUCGy8GCwkIBwMCBhUI 292 AgkKCwQWAgMBAh4BAheAAAoJEOfLr44BHbeTo+sH/i7bapIgPnZsJ81hmxPj4W12uvunksGJiC7d 293 4hIHsG7kmJRTJfjECi+AuTGeDwBy84TDcRaOB6e79fj65Fg6HgSahDUtKJbGxj/lWzmaBuTzlN3C 294 Ee8cMwIPqPT2kajJVdOyrvkyuFOdPFOEA7bdCH0MqgIdM2SdF8t40k/ATfuD2K1ZmumJ508I3gF3 295 9jgTnPzD4C8quswrMQ3bzfvKC3klXRlBC0yoArn+0QA3cf2B9T4zJ2qnvgotVbeK/b1OJRNj6Poe 296 o+SsWNc/A5mw7lGScnDgL3yfwCm1gQXaQKfOt5x+7GqhWDw10q+bJpJlI10FfzAnhMF9etSqSeUR 297 BRWdA5gEVduM9QEIAL53hJ5bZJ7oEDCnaY+SCzt9QsAfnFTAnZJQrvkvusJzrTQ088eUQmAjvxkf 298 Rqnv981fFwGnh2+I1Ktm698UAZS9Jt8yjak9wWUICKQO5QUt5k8cHwldQXNXVXFa+TpQWQR5yW1a 299 9okjh5o/3d4cBt1yZPUJJyLKY43Wvptb6EuEsScO2DnRkh5wSMDQ7dTooddJCmaq3LTjOleRFQbu 300 9ij386Do6jzK69mJU56TfdcydkxkWF5NZLGnED3lq+hQNbe+8UI5tD2oP/3r5tXKgMy1R/XPvR/z 301 bfwvx4FAKFOP01awLq4P3d/2xOkMu4Lu9p315E87DOleYwxk+FoTqXEAEQEAAQAH+wVyQXaNwnjQ 302 xfW+M8SJNo0C7e+0d7HsuBTA/d/eP4bj6+X8RaRFVwiMvSAoxsqBNCLJP00qzzKfRQWJseD1H35z 303 UjM7rNVUEL2k1yppyp61S0qj0TdhVUfJDYZqRYonVgRMvzfDTB1ryKrefKenQYL/jGd9VYMnKmWZ 304 6GVk4WWXXx61iOt2HNcmSXKetMM1Mg67woPZkA3fJaXZ+zW0zMu4lTSB7yl3+vLGIFYILkCFnREr 305 drQ+pmIMwozUAt+pBq8dylnkHh6g/FtRfWmLIMDqM1NlyuHRp3dyLDFdTA93osLG0QJblfX54W34 306 byX7a4HASelGi3nPjjOAsTFDkuEEANV2viaWk1CV4ryDrXGmy4Xo32Md+laGPRcVfbJ0mjZjhQsO 307 gWC1tjMs1qZMPhcrKIBCjjdAcAIrGV9h3CXc0uGuez4XxLO+TPBKaS0B8rKhnKph1YZuf+HrOhzS 308 astDnOjNIT+qucCL/qSbdYpj9of3yY61S59WphPOBjoVM3BFBADka6ZCk81gx8jA2E1e9UqQDmdM 309 FZaVA1E7++kqVSFRDJGnq+5GrBTwCJ+sevi+Rvf8Nx4AXvpCdtMBPX9RogsUFcR0pMrKBrgRo/Vg 310 EpuodY2Ef1VtqXR24OxtRf1UwvHKydIsU05rzMAy5uGgQvTzRTXxZFLGUY31wjWqmo9VPQP+PnwA 311 K83EV2kk2bsXwZ9MXg05iXqGQYR4bEc/12v04BtaNaDS53hBDO4JIa3Bnz+5oUoYhb8FgezUKA9I 312 n6RdKTTP1BLAu8titeozpNF07V++dPiSE2wrIVsaNHL1pUwW0ql50titVwe+EglWiCKPtJBcCPUA 313 3oepSPchiDjPqrNCYIkCPgQYAQIACQUCVduM9QIbLgEpCRDny6+OAR23k8BdIAQZAQIABgUCVduM 314 9QAKCRAID0JGyHtSGmqYB/4m4rJbbWa7dBJ8VqRU7ZKnNRDR9CVhEGipBmpDGRYulEimOPzLUX/Z 315 XZmTZzgemeXLBaJJlWnopVUWuAsyjQuZAfdd8nHkGRHG0/DGum0l4sKTta3OPGHNC1z1dAcQ1RCr 316 9bTD3PxjLBczdGqhzw71trkQRBRdtPiUchltPMIyjUHqVJ0xmg0hPqFic0fICsr0YwKoz3h9+QEc 317 ZHvsjSZjgydKvfLYcm+4DDMCCqcHuJrbXJKUWmJcXR0y/+HQONGrGJ5xWdO+6eJioPn2jVMnXCm4 318 EKc7fcLFrz/LKmJ8seXhxjM3EdFtylBGCrx3xdK0f+JDNQaC/rhUb5V2XuX6VwoH/AtY+XsKVYRf 319 NIupLOUcf/srsm3IXT4SXWVomOc9hjGQiJ3rraIbADsc+6bCAr4XNZS7moViAAcIPXFv3m3WfUln 320 G/om78UjQqyVACRZqqAGmuPq+TSkRUCpt9h+A39LQWkojHqyob3cyLgy6z9Q557O9uK3lQozbw2g 321 H9zC0RqnePl+rsWIUU/ga16fH6pWc1uJiEBt8UZGypQ/E56/343epmYAe0a87sHx8iDV+dNtDVKf 322 PRENiLOOc19MmS+phmUyrbHqI91c0pmysYcJZCD3a502X1gpjFbPZcRtiTmGnUKdOIu60YPNE4+h 323 7u2CfYyFPu3AlUaGNMBlvy6PEpU=`