1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
|
import json
import boto3
import pytest
from botocore.exceptions import ClientError
from moto import mock_aws
@mock_aws
def test_get_initial_policy():
client = boto3.client("secretsmanager", region_name="us-west-2")
client.create_secret(Name="test-secret")
resp = client.get_resource_policy(SecretId="test-secret")
assert resp.get("Name") == "test-secret"
assert "ARN" in resp
assert "ResourcePolicy" not in resp
@mock_aws
def test_put_resource_policy():
client = boto3.client("secretsmanager", region_name="us-west-2")
client.create_secret(Name="test-secret")
policy = {
"Statement": [
{
"Action": "secretsmanager:GetSecretValue",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:role/tf-acc-test-655046176950657276"
},
"Resource": "*",
"Sid": "EnableAllPermissions",
}
],
"Version": "2012-10-17",
}
resp = client.put_resource_policy(
SecretId="test-secret", ResourcePolicy=json.dumps(policy)
)
assert "ARN" in resp
assert "Name" in resp
resp = client.get_resource_policy(SecretId="test-secret")
assert "ResourcePolicy" in resp
assert json.loads(resp["ResourcePolicy"]) == policy
@mock_aws
def test_delete_resource_policy():
client = boto3.client("secretsmanager", region_name="us-west-2")
client.create_secret(Name="test-secret")
client.put_resource_policy(SecretId="test-secret", ResourcePolicy="some policy")
client.delete_resource_policy(SecretId="test-secret")
resp = client.get_resource_policy(SecretId="test-secret")
assert "ResourcePolicy" not in resp
@mock_aws
def test_policies_for_unknown_secrets():
client = boto3.client("secretsmanager", region_name="us-west-2")
with pytest.raises(ClientError) as exc:
client.put_resource_policy(SecretId="unknown secret", ResourcePolicy="p")
assert exc.value.response["Error"]["Code"] == "ResourceNotFoundException"
with pytest.raises(ClientError) as exc:
client.get_resource_policy(SecretId="unknown secret")
assert exc.value.response["Error"]["Code"] == "ResourceNotFoundException"
with pytest.raises(ClientError) as exc:
client.delete_resource_policy(SecretId="unknown secret")
assert exc.value.response["Error"]["Code"] == "ResourceNotFoundException"
|
