Sanity checks for the intended ACLs of the policy
(sts_conn, monkeypatch)
| 31 | |
| 32 | @pytest.mark.skipif("no_real_s3_credentials()") |
| 33 | def test_policy(sts_conn, monkeypatch): |
| 34 | """Sanity checks for the intended ACLs of the policy""" |
| 35 | monkeypatch.setenv('AWS_REGION', 'us-west-1') |
| 36 | # Use periods to force OrdinaryCallingFormat when using |
| 37 | # calling_format.from_store_name. |
| 38 | bn = bucket_name_mangle('wal-e.sts.list.test') |
| 39 | h = 's3-us-west-1.amazonaws.com' |
| 40 | cf = connection.OrdinaryCallingFormat() |
| 41 | |
| 42 | fed = sts_conn.get_federation_token('wal-e-test-list-bucket', |
| 43 | policy=make_policy(bn, 'test-prefix')) |
| 44 | test_payload = 'wal-e test' |
| 45 | |
| 46 | keys = ['test-prefix/hello', 'test-prefix/world', |
| 47 | 'not-in-prefix/goodbye', 'not-in-prefix/world'] |
| 48 | creds = Credentials(fed.credentials.access_key, |
| 49 | fed.credentials.secret_key, |
| 50 | fed.credentials.session_token) |
| 51 | |
| 52 | with FreshBucket(bn, keys=keys, calling_format=cf, host=h) as fb: |
| 53 | # Superuser creds, for testing keys not in the prefix. |
| 54 | bucket_superset_creds = fb.create(location='us-west-1') |
| 55 | |
| 56 | cinfo = calling_format.from_store_name(bn) |
| 57 | conn = cinfo.connect(creds) |
| 58 | conn.host = h |
| 59 | |
| 60 | # Bucket using the token, subject to the policy. |
| 61 | bucket = conn.get_bucket(bn, validate=False) |
| 62 | |
| 63 | for name in keys: |
| 64 | if name.startswith('test-prefix/'): |
| 65 | # Test the PUT privilege. |
| 66 | k = connection.Key(bucket) |
| 67 | else: |
| 68 | # Not in the prefix, so PUT will not work. |
| 69 | k = connection.Key(bucket_superset_creds) |
| 70 | |
| 71 | k.key = name |
| 72 | k.set_contents_from_string(test_payload) |
| 73 | |
| 74 | # Test listing keys within the prefix. |
| 75 | prefix_fetched_keys = list(bucket.list(prefix='test-prefix/')) |
| 76 | assert len(prefix_fetched_keys) == 2 |
| 77 | |
| 78 | # Test the GET privilege. |
| 79 | for key in prefix_fetched_keys: |
| 80 | assert key.get_contents_as_string() == b'wal-e test' |
| 81 | |
| 82 | # Try a bogus listing outside the valid prefix. |
| 83 | with pytest.raises(exception.S3ResponseError) as e: |
| 84 | list(bucket.list(prefix='')) |
| 85 | |
| 86 | assert e.value.status == 403 |
| 87 | |
| 88 | # Test the rejection of PUT outside of prefix. |
| 89 | k = connection.Key(bucket) |
| 90 | k.key = 'not-in-prefix/world' |
nothing calls this directly
no test coverage detected